Merge commit 'f9939dd1d722b997c6f1522237ae2e53fd9e239c' into fix/exec-recovery-diagnostics-a2

Why: A2 - answer where a run is stuck, who is responsible, why it
waits, the last stable checkpoint, known side effects and the next
step, from existing records only (recovery holds, HITL decisions,
confirmation cards, audit envelopes).
Evidence: rundiag/server/store tests pass (verify-a2.json); per-state
responsibility, scoping and next-step mapping cases added.
Impact: one read-only GET endpoint plus read helpers; no behavior
change to execution or recovery paths.
Refs: feature/exec-recovery-diagnostics-a2

cmd/storage-migrate/main.go

@@ -307,6 +307,10 @@ var copyOrder = []string{
 	"exec_env_requests", "exec_env_bindings",
 	// U8：活动服务锁的库内标记（无外键；迁移须保留以免目标库丢掉锁根）
 	"instance_guard",
+	// v52 intent_session（A1/U-A1b）：会话维度的挂起动作预期 + 已收集槽位
+	// （无外键，纯数据表；键含 owner+project+conversation，随 conversations
+	// 之后迁移即可，无需额外排序）
+	"intent_session",
 }
 
 // schemaSeededSingletons：schema 迁移在每个新库上预置的单行表。它们不是目标

internal/app/app.go

@@ -8,6 +8,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"net"
@@ -24,13 +25,10 @@ import (
 	"logging-system/logsys"
 	"logging-system/sink"
 
-	"agent-native/runtime/checkpoint"
 	agentllm "agent-native/runtime/llm"
 	agentmcp "agent-native/runtime/mcp"
-	"agent-native/runtime/policy"
 	"agent-native/runtime/telemetry"
 	agenttools "agent-native/runtime/tools"
-	nativeadp "agent-squad/adapters/native"
 	"agent-system-backend/internal/bus"
 	"agent-system-backend/internal/cardsvc"
 	"agent-system-backend/internal/cmdbus"
@@ -332,98 +330,20 @@ func Run(opt Options) error {
 		}
 	}
 	tools.SetSkillsRoot(skillsRoot)
-	// 小队的 agent-native 内核工厂（组合根装配，逐次运行时从 settings 解析）：
-	// 模型走 settings.models.chat 同一路由；搜索/解释器/MCP/技能根复用产品配置；
-	// 委派桥接产品 SpawnSubagent。主模型未配置时返回未启用（不阻塞产品）。
+	// 小队的 agent-native 内核工厂（组合根装配，逐次运行时按当前运行的用户/项目
+	// 解析）：模型走 settings.models.chat 同一路由与同一 per-route 规则；
+	// 搜索/解释器/MCP/技能根复用产品配置；委派桥接产品 SpawnSubagent。
+	// 主模型未配置时返回未启用（不阻塞产品）。装配见 squad_native.go。
 	var pluginHost *plugins.Host
-	squadadapter.AgentNativeOptions = func(rc squadadapter.Ctx) (nativeadp.Config, bool) {
-		effNow := setSvc.Effective(store.OwnerDefault, "")
-		route := runtime.ResolveChatModel(core.AgentProfile{}, effNow)
-		if route.Model == "" || route.Base == "" {
-			return nativeadp.Config{}, false
-		}
-		mode := "default"
-		if src, ok := rc.(interface{ PermissionMode() string }); ok {
-			mode = src.PermissionMode()
-		}
-		cfg := nativeadp.Config{
-			Client:       &agentllm.Client{BaseURL: route.Base, APIKey: route.Key, HTTPClient: &http.Client{}},
-			DefaultModel: route.Model,
-			MaxTurns:     0,
-			Timeout:      0,
-			Subagent:     squadadapter.SubagentFactory(rc),
-			RepeatGuard:  true,
-			BeforeTool: func(call agentllm.ToolCall) error {
-				effect := policy.Decide(policy.Request{
-					Mode: policy.Normalize(mode), Name: call.Name, Args: call.Arguments,
-					Traits: policy.TraitsFor(call.Name),
-				}, nil)
-				if effect == policy.EffectDeny {
-					return fmt.Errorf("计划模式拒绝了工具 %s", call.Name)
-				}
+	squadadapter.AgentNativeOptions = squadAgentNativeFactory(squadNativeDeps{
+		set: setSvc, secrets: st, skillsRoot: skillsRoot, trace: traceFn, mcp: mcpManagerFor,
+		pluginMCP: func() []core.PluginMCPServer {
+			if pluginHost == nil {
 				return nil
-			},
-		}
-		cfg.Stream = runtime.GuardProjectStream(rc, "", cfg.Client.Stream)
-		if keys := tavilyKeyPool(st, effNow.GetString("tools.tavily.apiKeys", "")); len(keys) > 0 {
-			cfg.Search = agenttools.NewTavilyProvider(effNow.GetString("tools.tavily.endpoint", ""), keys)
-		}
-		if effNow.GetBool("runtime.exec", true) {
-			cfg.Exec = tools.InterpreterExecConfig()
-		}
-		if st2, err := os.Stat(skillsRoot); err == nil && st2.IsDir() {
-			cfg.SkillsRoots = []string{skillsRoot}
-		}
-		rawMCP := strings.TrimSpace(effNow.GetString("tools.mcp.servers", ""))
-		if pluginHost != nil {
-			rawMCP = mergeMCPServers(rawMCP, pluginHost.MCPServers())
-		}
-		if mgr := mcpManagerFor(rawMCP, strings.TrimSpace(effNow.GetString("tools.mcp.overrides", ""))); mgr != nil {
-			cfg.MCP = mgr
-		}
-		// Native squad tools do not yet expose a fail-closed result hook to the
-		// project observation outbox. Project runs therefore use the audited
-		// runCtx retrieval/tool path only; enabling these direct providers would
-		// let their results reach the next model turn without source analysis.
-		if rc.Run().ProjectID != "" {
-			cfg.Search = nil
-			cfg.Exec = nil
-			cfg.Fetch = nil
-			cfg.MCP = nil
-		}
-		cfg.CodeOrchestration = rc.Run().ProjectID == "" && effNow.GetBool("runtime.codeOrchestration", false)
-		if ask, ok := rc.(interface {
-			AskUser(card core.HITLCard) (core.HITLResponse, error)
-		}); ok {
-			cfg.Ask = func(_ context.Context, question string) (string, error) {
-				resp, err := ask.AskUser(core.HITLCard{
-					Question: question, Kind: core.HITLKindInput, AllowFreeInput: true,
-				})
-				if err != nil {
-					return "", err
-				}
-				if strings.TrimSpace(resp.FreeText) != "" {
-					return strings.TrimSpace(resp.FreeText), nil
-				}
-				return resp.ChoiceID, nil
 			}
-		}
-		cfg.Trace = traceFn
-		// N1 WP4：小队成员的内核 ask 决策经 GateOptions.PermissionAsk 到达
-		// runCtx 的 HITL 确认卡（宿主无实现则 nil，内核保持 ask=拒绝旧行为）。
-		cfg.PermissionAsk = runtime.PermissionAskOf(rc)
-		if host, ok := rc.(interface {
-			OpenCheckpoints() (*checkpoint.Log, error)
-			CheckpointAnchor() string
-		}); ok {
-			if lg, err := host.OpenCheckpoints(); err == nil {
-				cfg.Checkpoints = lg
-				anchor := host.CheckpointAnchor()
-				cfg.CheckpointAnchor = func() string { return anchor }
-			}
-		}
-		return cfg, true
-	}
+			return pluginHost.MCPServers()
+		},
+	})
 	profSvc := profiles.New(st)
 	if err := profSvc.EnsureDefault(); err != nil {
 		return fmt.Errorf("default profile: %w", err)
@@ -623,10 +543,16 @@ func Run(opt Options) error {
 			}
 			return nil
 		}}
+	bus.SetHostProjectGuard(func(_ context.Context, req cmdbus.Request) error {
+		return scratchCommandHostGuard(st, req)
+	})
 	bus.SetProjectWorkPreflight(func(ctx context.Context, req cmdbus.Request) error {
 		if req.Actor == "" || req.Actor != req.Owner || req.ConversationID == "" || req.AnchorMessageID == "" || req.HostProjectID == "" {
 			return fmt.Errorf("formal project command requires an authenticated conversation source")
 		}
+		if err := rejectScratchCommandHost(st, req); err != nil {
+			return err
+		}
 		conv, err := st.GetConversation(req.Owner, req.ConversationID)
 		if err != nil || string(conv.ProjectID) != req.HostProjectID {
 			return fmt.Errorf("formal project command conversation binding changed")
@@ -1123,6 +1049,38 @@ func splitKeyPool(s string) []string {
 	return out
 }
 
+// ErrScratchCommandHost 是命令分发的临时会话门禁：临时会话没有 RDM 项目域，
+// 任何以基座项目为前提的命令（rdm.* 与正式项目命令）在里面一律不可用。
+var ErrScratchCommandHost = errors.New("not available in scratch sessions")
+
+// rejectScratchCommandHost 在命令总线内部分发（宿主与插件处理器共用的分发面）
+// 上执行同一个门禁。基座项目是临时会话时拒绝；不是临时会话（包括项目读不到）
+// 时交回原路径，不改变任何现有判定。
+func rejectScratchCommandHost(st *store.Store, req cmdbus.Request) error {
+	if st == nil || req.HostProjectID == "" {
+		return nil
+	}
+	handled, err := st.ScratchProjectDecision(req.HostProjectID, req.Owner)
+	if err != nil {
+		return err
+	}
+	if handled {
+		return ErrScratchCommandHost
+	}
+	return nil
+}
+
+// scratchCommandHostGuard 是命令总线上的基座项目门禁（组合根装配）：
+// 项目域命令（rdm.* 全族与正式项目命令 cmdbus.RequiresProjectWorkDecision）在
+// 临时会话宿主上一律拒绝，其它命令与普通项目宿主原样通过。它挂在分发面本身，
+// 所以聊天意图路由与 system.intent 再分发不再绕过 HTTP 403 与正式命令预检。
+func scratchCommandHostGuard(st *store.Store, req cmdbus.Request) error {
+	if !strings.HasPrefix(req.ID, "rdm.") && !cmdbus.RequiresProjectWorkDecision(req.ID) {
+		return nil
+	}
+	return rejectScratchCommandHost(st, req)
+}
+
 // busAdapter EXT-14：cmdbus.Bus 适配 runmgr.CommandSource。视图类型转换在此收口
 // （runmgr 不依赖 cmdbus，边不进架构基线）；Entrance 由 runmgr 固定为 agent。
 type busAdapter struct{ bus *cmdbus.Bus }

internal/app/scratch_gates_test.go

@@ -0,0 +1,181 @@
+package app
+
+// 临时会话的内部命令分发门禁（U2）：组合根在命令总线的项目预检入口上拒绝
+// “基座项目是临时会话”的正式项目命令，宿主与插件处理器共用这一条分发面。
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+func newScratchGateStore(t *testing.T) (*store.Store, core.Project, core.Conversation) {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "scratch-gate.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("alice", "Alice", "", false); err != nil {
+		t.Fatal(err)
+	}
+	project, conversation, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return st, project, conversation
+}
+
+// TestScratchCommandHostGateDecidesOwnership 门禁本身：属主的临时会话拒绝，
+// 普通项目与无基座项目的分发不受影响；非属主按存储判定（NotFound）。
+func TestScratchCommandHostGateDecidesOwnership(t *testing.T) {
+	st, project, _ := newScratchGateStore(t)
+
+	if err := rejectScratchCommandHost(st, cmdbus.Request{
+		ID: "rdm.reqs.add", Owner: "alice", HostProjectID: string(project.ID),
+	}); !errors.Is(err, ErrScratchCommandHost) {
+		t.Fatalf("scratch host project accepted a formal command: %v", err)
+	}
+	normal, err := st.CreateProject("alice", "普通项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := rejectScratchCommandHost(st, cmdbus.Request{
+		ID: "rdm.reqs.add", Owner: "alice", HostProjectID: string(normal.ID),
+	}); err != nil {
+		t.Fatalf("normal host project refused: %v", err)
+	}
+	if err := rejectScratchCommandHost(st, cmdbus.Request{ID: "rdm.reqs.add", Owner: "alice"}); err != nil {
+		t.Fatalf("hostless dispatch refused: %v", err)
+	}
+	// 非属主不能把自己的“属主身份”带进临时会话。
+	if err := rejectScratchCommandHost(st, cmdbus.Request{
+		ID: "rdm.reqs.add", Owner: "bob", HostProjectID: string(project.ID),
+	}); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("non-owner scratch dispatch = %v", err)
+	}
+}
+
+// TestScratchCommandHostGateOnBusPreflight 门禁在真实分发面上生效：正式项目命令
+// 在临时会话宿主上被拒，普通项目宿主不受影响（失败原因来自后续的会话来源校验，
+// 不是临时会话门禁）。
+func TestScratchCommandHostGateOnBusPreflight(t *testing.T) {
+	st, project, conversation := newScratchGateStore(t)
+	normal, err := st.CreateProject("alice", "普通项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	normalConv, err := st.CreateConversation("alice", string(normal.ID), "会话", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bus := cmdbus.New(st, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	bus.SetProjectWorkPreflight(func(ctx context.Context, req cmdbus.Request) error {
+		if req.Actor == "" || req.Actor != req.Owner || req.ConversationID == "" || req.AnchorMessageID == "" || req.HostProjectID == "" {
+			return errors.New("formal project command requires an authenticated conversation source")
+		}
+		if err := rejectScratchCommandHost(st, req); err != nil {
+			return err
+		}
+		conv, err := st.GetConversation(req.Owner, req.ConversationID)
+		if err != nil || string(conv.ProjectID) != req.HostProjectID {
+			return errors.New("formal project command conversation binding changed")
+		}
+		return errors.New("source analysis did not commit a proceed decision")
+	})
+	if err := bus.RegisterPluginCommand(agentcommand.CommandSpec{ID: "rdm.reqs.add", Title: "登记需求"},
+		func(context.Context, cmdbus.Request) (any, error) { return map[string]any{"ok": true}, nil }); err != nil {
+		t.Fatal(err)
+	}
+
+	scratchResp := bus.Dispatch(context.Background(), cmdbus.Request{
+		ID: "rdm.reqs.add", Entrance: "api", Actor: "alice", Owner: "alice",
+		ConversationID: string(conversation.ID), AnchorMessageID: "msg-1", HostProjectID: string(project.ID),
+	})
+	if scratchResp.Receipt.State != agentcommand.StateRejected ||
+		!strings.Contains(scratchResp.Receipt.Reason, ErrScratchCommandHost.Error()) {
+		t.Fatalf("scratch host dispatch = %+v (want %s)", scratchResp.Receipt, ErrScratchCommandHost)
+	}
+
+	normalResp := bus.Dispatch(context.Background(), cmdbus.Request{
+		ID: "rdm.reqs.add", Entrance: "api", Actor: "alice", Owner: "alice",
+		ConversationID: string(normalConv.ID), AnchorMessageID: "msg-1", HostProjectID: string(normal.ID),
+	})
+	if normalResp.Receipt.State != agentcommand.StateRejected ||
+		strings.Contains(normalResp.Receipt.Reason, ErrScratchCommandHost.Error()) {
+		t.Fatalf("normal host dispatch was blocked by the scratch gate: %+v", normalResp.Receipt)
+	}
+}
+
+// TestScratchCommandHostGateOnBusDispatch 基座项目门禁挂在命令总线上（组合根的
+// 真实接线）：不经 HTTP 403、也不经正式命令预检——聊天意图路由与 system.intent
+// 再分发走的就是这条面——rdm.* 在临时会话宿主上被拒且处理器不会被调用；普通项目
+// 宿主与无宿主分发不受这条门禁影响。
+func TestScratchCommandHostGateOnBusDispatch(t *testing.T) {
+	st, project, conversation := newScratchGateStore(t)
+	normal, err := st.CreateProject("alice", "普通项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bus := cmdbus.New(st, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	handled, preflights := 0, 0
+	bus.SetHostProjectGuard(func(_ context.Context, req cmdbus.Request) error {
+		return scratchCommandHostGuard(st, req)
+	})
+	bus.SetProjectWorkPreflight(func(context.Context, cmdbus.Request) error { preflights++; return nil })
+	for _, spec := range []agentcommand.CommandSpec{
+		{ID: "rdm.reqs.add", Title: "登记需求"},
+		{ID: "demo.ping", Title: "会话命令"},
+	} {
+		id := spec.ID
+		if err := bus.RegisterPluginCommand(spec,
+			func(context.Context, cmdbus.Request) (any, error) { handled++; return map[string]any{"id": id}, nil }); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	scratchResp := bus.Dispatch(context.Background(), cmdbus.Request{
+		ID: "rdm.reqs.add", Entrance: "chat", Actor: "alice", Owner: "alice",
+		ConversationID: string(conversation.ID), AnchorMessageID: "msg-1", HostProjectID: string(project.ID),
+	})
+	if scratchResp.Receipt.State != agentcommand.StateRejected ||
+		!strings.HasPrefix(scratchResp.Receipt.Reason, "host project: ") ||
+		!strings.Contains(scratchResp.Receipt.Reason, ErrScratchCommandHost.Error()) {
+		t.Fatalf("scratch host dispatch = %+v (want host project: %s)", scratchResp.Receipt, ErrScratchCommandHost)
+	}
+	if handled != 0 || preflights != 0 {
+		t.Fatalf("scratch host reached the command handler %d times / preflight %d times", handled, preflights)
+	}
+	// 同一宿主上的会话类命令照旧可用（临时会话不是禁用一切命令）。
+	if resp := bus.Dispatch(context.Background(), cmdbus.Request{
+		ID: "demo.ping", Entrance: "chat", Actor: "alice", Owner: "alice",
+		ConversationID: string(conversation.ID), AnchorMessageID: "msg-1", HostProjectID: string(project.ID),
+	}); resp.Receipt.State != agentcommand.StateCommitted {
+		t.Fatalf("conversation command on a scratch host = %+v", resp.Receipt)
+	}
+	// 正面：普通项目宿主不被这条门禁拒绝；无宿主的分发也不走门禁。
+	for _, req := range []cmdbus.Request{
+		{ID: "rdm.reqs.add", Entrance: "chat", Actor: "alice", Owner: "alice", HostProjectID: string(normal.ID)},
+		{ID: "rdm.reqs.add", Entrance: "api", Actor: "alice", Owner: "alice"},
+	} {
+		if err := scratchCommandHostGuard(st, req); err != nil {
+			t.Fatalf("host guard refused %+v: %v", req, err)
+		}
+	}
+	resp := bus.Dispatch(context.Background(), cmdbus.Request{
+		ID: "rdm.reqs.add", Entrance: "chat", Actor: "alice", Owner: "alice", HostProjectID: string(normal.ID),
+	})
+	if resp.Receipt.State != agentcommand.StateCommitted || strings.Contains(resp.Receipt.Reason, ErrScratchCommandHost.Error()) || handled != 2 {
+		t.Fatalf("normal host dispatch was blocked by the scratch gate: %+v (handler calls %d)", resp.Receipt, handled)
+	}
+}

internal/app/squad_config_test.go

@@ -0,0 +1,443 @@
+// 小队内核配置的归属测试（F13 / KTD3）：内核用的模型、端点、密钥必须整条来自
+// 「本次运行」的生效快照，不得按默认账号重新解析——否则一个用户的模型名会配
+// 上另一个账号的端点/密钥。全部使用合成密钥与本地假服务。
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	agentllm "agent-native/runtime/llm"
+	"agent-system-backend/internal/runtime"
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/squadadapter"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+// squadRunCtx 是适配器窄端口的最小宿主实现：只有配置作用域（无 Profile 端口，
+// 属主只能来自 run）。
+type squadRunCtx struct {
+	run core.Run
+	eff core.EffectiveSettings
+}
+
+func (c *squadRunCtx) Context() context.Context             { return context.Background() }
+func (c *squadRunCtx) Run() core.Run                        { return c.run }
+func (c *squadRunCtx) Settings() core.EffectiveSettings     { return c.eff }
+func (c *squadRunCtx) Emit(core.StreamEventType, any) error { return nil }
+func (c *squadRunCtx) UpdatePlan(core.PlanSnapshot) error   { return nil }
+func (c *squadRunCtx) SpawnSubagent(string, string, string) (core.AgentResultPayload, error) {
+	return core.AgentResultPayload{}, nil
+}
+func (c *squadRunCtx) AskHITL(core.HITLCard) (core.HITLResponse, error) {
+	return core.HITLResponse{}, nil
+}
+func (c *squadRunCtx) WriteArtifact(string, string, string, []byte) (core.Artifact, error) {
+	return core.Artifact{}, nil
+}
+
+var _ squadadapter.Ctx = (*squadRunCtx)(nil)
+
+// squadProfileRunCtx 是带画像端口的宿主（runmgr 的 runCtx 形态）：画像的
+// Owner 与 run.Owner 一致，模型覆盖按直连规则生效。
+type squadProfileRunCtx struct {
+	*squadRunCtx
+	prof core.AgentProfile
+}
+
+func (c *squadProfileRunCtx) Profile() core.AgentProfile { return c.prof }
+
+// squadSecretStub 是受管密钥来源桩（Tavily 池按 owner 查）。
+type squadSecretStub map[string]string
+
+func (s squadSecretStub) ActiveSecret(owner, _ string) (string, bool) {
+	v, ok := s[owner]
+	return v, ok
+}
+
+func squadStore(t *testing.T) (*store.Store, *settings.Service) {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "squad.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return st, settings.NewService(st)
+}
+
+// squadLLMCall 是一次上游请求的观测（只记合成字段）。
+type squadLLMCall struct {
+	Path           string
+	Authorization  string
+	Model          string
+	ReasoningSplit bool
+}
+
+func squadLLMServer(t *testing.T) (*httptest.Server, func() []squadLLMCall) {
+	t.Helper()
+	var mu sync.Mutex
+	var calls []squadLLMCall
+	frame := func(v any) string {
+		raw, err := json.Marshal(v)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return "data: " + string(raw) + "\n\n"
+	}
+	body := frame(map[string]any{"choices": []any{map[string]any{"delta": map[string]any{"content": "ok"}}}}) +
+		frame(map[string]any{"choices": []any{map[string]any{"delta": map[string]any{}, "finish_reason": "stop"}}}) +
+		frame(map[string]any{"choices": []any{}, "usage": map[string]any{"prompt_tokens": 1, "completion_tokens": 1, "total_tokens": 2}}) +
+		"data: [DONE]\n\n"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		raw, _ := io.ReadAll(r.Body)
+		var decoded struct {
+			Model          string `json:"model"`
+			ReasoningSplit bool   `json:"reasoning_split"`
+		}
+		_ = json.Unmarshal(raw, &decoded)
+		mu.Lock()
+		calls = append(calls, squadLLMCall{
+			Path: r.URL.Path, Authorization: r.Header.Get("Authorization"),
+			Model: decoded.Model, ReasoningSplit: decoded.ReasoningSplit,
+		})
+		mu.Unlock()
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = io.WriteString(w, body)
+	}))
+	t.Cleanup(server.Close)
+	return server, func() []squadLLMCall {
+		mu.Lock()
+		defer mu.Unlock()
+		return append([]squadLLMCall(nil), calls...)
+	}
+}
+
+// squadCall 驱动装配出的内核流一次，返回终态事件。
+func squadCall(t *testing.T, stream agentllm.StreamFunc, model string) []agentllm.Event {
+	t.Helper()
+	if stream == nil {
+		t.Fatal("squad config produced no stream")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+	var terminal []agentllm.Event
+	for ev := range stream(ctx, model, []agentllm.Message{{Role: agentllm.RoleUser, Content: "hi"}}, nil, agentllm.StreamOptions{}) {
+		if ev.Kind == agentllm.KindMessageEnd || ev.Kind == agentllm.KindError {
+			terminal = append(terminal, ev)
+		}
+	}
+	if len(terminal) != 1 || terminal[0].Kind != agentllm.KindMessageEnd || terminal[0].Err != nil {
+		t.Fatalf("terminal events = %+v, want one clean message_end", terminal)
+	}
+	return terminal
+}
+
+func chatEff(model, base, key string) core.EffectiveSettings {
+	return core.EffectiveSettings{"models": map[string]any{"chat": map[string]any{
+		"model": model, "baseUrl": base, "apiKey": key,
+	}}}
+}
+
+// 两位用户的端点/密钥/模型各不相同：装配必须整条取自本次运行的快照。
+func TestSquadNativeOptionsResolvesRouteFromRunScope(t *testing.T) {
+	aliceSrv, aliceCalls := squadLLMServer(t)
+	bobSrv, bobCalls := squadLLMServer(t)
+
+	// 默认账号：与两位用户都不同；小队路径不得解析到它。
+	_, svc := squadStore(t)
+	if err := svc.MergeSystem(map[string]any{"models": map[string]any{"chat": map[string]any{
+		"model": "default-account-model", "baseUrl": "https://default.invalid/v1", "apiKey": "sk-default-synthetic",
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+	factory := squadAgentNativeFactory(squadNativeDeps{set: svc, secrets: squadSecretStub{}})
+
+	for _, tc := range []struct {
+		owner   core.ID
+		model   string
+		base    string
+		key     string
+		calls   func() []squadLLMCall
+		foreign []string
+	}{
+		{"alice", "alice-model", aliceSrv.URL + "/v1", "sk-alice-synthetic", aliceCalls,
+			[]string{"bob-model", "sk-bob-synthetic", "default-account-model", "sk-default-synthetic"}},
+		{"bob", "bob-model", bobSrv.URL + "/v1", "sk-bob-synthetic", bobCalls,
+			[]string{"alice-model", "sk-alice-synthetic", "default-account-model", "sk-default-synthetic"}},
+	} {
+		t.Run(string(tc.owner), func(t *testing.T) {
+			cfg, enabled := factory(&squadRunCtx{
+				run: core.Run{ID: "run_" + string(tc.owner), Owner: tc.owner},
+				eff: chatEff(tc.model, tc.base, tc.key),
+			})
+			if !enabled || cfg.Client == nil {
+				t.Fatalf("factory disabled: enabled=%v cfg=%+v", enabled, cfg)
+			}
+			if cfg.DefaultModel != tc.model {
+				t.Fatalf("model = %q, want %q", cfg.DefaultModel, tc.model)
+			}
+			if cfg.Client.BaseURL != tc.base || cfg.Client.APIKey != tc.key {
+				t.Fatalf("route = %q/%q, want %q/%q", cfg.Client.BaseURL, cfg.Client.APIKey, tc.base, tc.key)
+			}
+			for _, foreign := range tc.foreign {
+				if strings.Contains(cfg.DefaultModel+cfg.Client.BaseURL+cfg.Client.APIKey, foreign) {
+					t.Fatalf("squad config leaked another account's value %q: model=%q base=%q key=%q",
+						foreign, cfg.DefaultModel, cfg.Client.BaseURL, cfg.Client.APIKey)
+				}
+			}
+			// 真正发一次请求：模型名、端点与密钥必须成对出现在同一次调用里。
+			squadCall(t, cfg.Stream, cfg.DefaultModel)
+			calls := tc.calls()
+			if len(calls) != 1 {
+				t.Fatalf("upstream calls = %d, want exactly 1", len(calls))
+			}
+			if calls[0].Path != "/v1/chat/completions" {
+				t.Fatalf("request path = %q, want the run's own endpoint", calls[0].Path)
+			}
+			if calls[0].Authorization != "Bearer "+tc.key {
+				t.Fatalf("authorization = %q, want the run's own key", calls[0].Authorization)
+			}
+			if calls[0].Model != tc.model {
+				t.Fatalf("request model = %q, want %q", calls[0].Model, tc.model)
+			}
+		})
+	}
+}
+
+// 受管密钥按属主隔离：画像里的 Owner 决定密钥层归属，不得借默认/系统账号的。
+func TestSquadNativeOptionsNeverBorrowsAnotherOwnerSecret(t *testing.T) {
+	st, svc := squadStore(t)
+	srv, _ := squadLLMServer(t)
+	base := srv.URL + "/v1"
+	if err := svc.MergeSystem(map[string]any{"models": map[string]any{"chat": map[string]any{
+		"model": "shared-model", "baseUrl": base,
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+	for owner, value := range map[string]string{
+		settings.OwnerSystemRow: "sk-system-synthetic",
+		"alice":                 "sk-alice-synthetic",
+		"bob":                   "sk-bob-synthetic",
+		store.OwnerDefault:      "sk-default-synthetic",
+	} {
+		if _, err := st.AddSecret(owner, "models.chat", "test", value); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// 与组合根同一套解析规则：属主 → 系统行 → 无。
+	saved := runtime.SecretLookup
+	runtime.SecretLookup = func(owner, service string) (string, string, bool) {
+		if owner == "" {
+			owner = store.OwnerDefault
+		}
+		if v, ok := st.ActiveSecret(owner, service); ok {
+			return v, "owner", true
+		}
+		if v, ok := st.ActiveSecret(settings.OwnerSystemRow, service); ok {
+			return v, "system", true
+		}
+		return "", "", false
+	}
+	t.Cleanup(func() { runtime.SecretLookup = saved })
+
+	factory := squadAgentNativeFactory(squadNativeDeps{set: svc, secrets: squadSecretStub{}})
+	for _, tc := range []struct {
+		owner, model, key string
+	}{
+		{"alice", "alice-profile-model", "sk-alice-synthetic"},
+		{"bob", "bob-profile-model", "sk-bob-synthetic"},
+		// 无自有密钥的租户仍按既有规则回落系统行受管密钥（不是默认账号的）。
+		{"carol", "shared-model", "sk-system-synthetic"},
+	} {
+		t.Run(tc.owner, func(t *testing.T) {
+			prof := core.AgentProfile{Owner: tc.owner}
+			if tc.model != "shared-model" {
+				prof.Model = core.ModelRoute{Chat: tc.model}
+			}
+			cfg, enabled := factory(&squadProfileRunCtx{
+				squadRunCtx: &squadRunCtx{
+					run: core.Run{ID: "run_" + tc.owner, Owner: tc.owner},
+					eff: svc.Effective(tc.owner, ""),
+				},
+				prof: prof,
+			})
+			if !enabled {
+				t.Fatal("factory disabled for a configured run")
+			}
+			if cfg.DefaultModel != tc.model || cfg.Client.APIKey != tc.key {
+				t.Fatalf("route = %q/%q, want %q/%q", cfg.DefaultModel, cfg.Client.APIKey, tc.model, tc.key)
+			}
+			if cfg.Client.BaseURL != base {
+				t.Fatalf("base = %q, want %q", cfg.Client.BaseURL, base)
+			}
+			// 无 Profile 端口时属主只能来自 run.Owner——密钥层不得退化成默认账号。
+			bare, _ := factory(&squadRunCtx{
+				run: core.Run{ID: "run_" + tc.owner, Owner: tc.owner},
+				eff: svc.Effective(tc.owner, ""),
+			})
+			if bare.Client.APIKey != tc.key || bare.Client.BaseURL != base {
+				t.Fatalf("owner from run = %q/%q, want %q/%q", bare.Client.APIKey, bare.Client.BaseURL, tc.key, base)
+			}
+		})
+	}
+}
+
+// 项目运行消费的是「用户层 + 项目层」合并后的快照：项目覆盖的键取项目，
+// 未覆盖的键仍留用户层，绝不整包换回默认账号。
+func TestSquadNativeOptionsHonorsProjectLayerSnapshot(t *testing.T) {
+	_, svc := squadStore(t)
+	if err := svc.MergeSystem(map[string]any{"models": map[string]any{"chat": map[string]any{
+		"model": "default-account-model", "baseUrl": "https://default.invalid/v1", "apiKey": "sk-default-synthetic",
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+	projSrv, projCalls := squadLLMServer(t)
+	userLayer := map[string]any{
+		"models": map[string]any{"chat": map[string]any{
+			"model": "user-model", "baseUrl": "https://user.invalid/v1", "apiKey": "sk-user-synthetic",
+		}},
+		"tools":   map[string]any{"tavily": map[string]any{"apiKeys": "tvly-user-synthetic"}},
+		"runtime": map[string]any{"codeOrchestration": true, "exec": true},
+	}
+	projectLayer := map[string]any{"models": map[string]any{"chat": map[string]any{
+		"baseUrl": projSrv.URL + "/v1", "apiKey": "sk-project-synthetic",
+	}}}
+	eff := core.EffectiveSettings(core.MergeSettings(userLayer, projectLayer))
+
+	factory := squadAgentNativeFactory(squadNativeDeps{
+		set: svc, secrets: squadSecretStub{store.OwnerDefault: "tvly-active-synthetic"},
+	})
+	cfg, enabled := factory(&squadProfileRunCtx{
+		squadRunCtx: &squadRunCtx{run: core.Run{ID: "run_proj", Owner: "alice", ProjectID: "proj1"}, eff: eff},
+		prof:        core.AgentProfile{Owner: "alice"},
+	})
+	if !enabled {
+		t.Fatal("factory disabled for a configured project run")
+	}
+	if cfg.DefaultModel != "user-model" {
+		t.Fatalf("model = %q, want the user-layer value %q", cfg.DefaultModel, "user-model")
+	}
+	if cfg.Client.BaseURL != projSrv.URL+"/v1" || cfg.Client.APIKey != "sk-project-synthetic" {
+		t.Fatalf("route = %q/%q, want the project-layer endpoint and key", cfg.Client.BaseURL, cfg.Client.APIKey)
+	}
+	// 直接驱动内核客户端（受保护的 cfg.Stream 在无项目上下文端口的桩上按
+	// 设计 fail-closed，不用于本断言）：模型名、端点与密钥成对出现。
+	squadCall(t, cfg.Client.Stream, cfg.DefaultModel)
+	calls := projCalls()
+	if len(calls) != 1 || calls[0].Authorization != "Bearer sk-project-synthetic" || calls[0].Model != "user-model" {
+		t.Fatalf("upstream calls = %+v, want the project endpoint with the user-layer model", calls)
+	}
+	// 项目来源的观察/授权限制不得因为改配置解析而放宽。
+	if cfg.Search != nil || cfg.Exec != nil || cfg.Fetch != nil || cfg.MCP != nil {
+		t.Fatalf("project run kept direct providers: search=%v exec=%v fetch=%v mcp=%v", cfg.Search != nil, cfg.Exec != nil, cfg.Fetch != nil, cfg.MCP != nil)
+	}
+	if cfg.CodeOrchestration {
+		t.Fatal("project run kept code orchestration")
+	}
+}
+
+// per-route 规则与直连同源：画像模型覆盖后，reasoning split 与受限 EOF 契约
+// 都按「覆盖后这条路由」判定。
+func TestSquadNativeOptionsMatchesDirectRouteRules(t *testing.T) {
+	_, svc := squadStore(t)
+	// 契约只认规范化后的 https 端点，所以这里用合成端点（不发请求）。
+	base := "https://model.example.com/v1"
+	if err := svc.MergeSystem(map[string]any{"models": map[string]any{
+		"chat": map[string]any{"model": "MiniMax-M1", "baseUrl": base},
+		"routeContractEOF": map[string]any{
+			"model":          "MiniMax-M1",
+			"baseUrl":        base,
+			"identitySha256": agentllm.RouteContractIdentity("MiniMax-M1", base),
+		},
+	}}); err != nil {
+		t.Fatal(err)
+	}
+	factory := squadAgentNativeFactory(squadNativeDeps{set: svc, secrets: squadSecretStub{}})
+	eff := svc.Effective("alice", "")
+
+	for _, tc := range []struct {
+		name         string
+		profile      core.AgentProfile
+		model        string
+		wantSplit    bool
+		wantContract bool
+	}{
+		{"settings route", core.AgentProfile{Owner: "alice"}, "MiniMax-M1", true, true},
+		{"profile keeps reasoning split, drops contract", core.AgentProfile{Owner: "alice", Model: core.ModelRoute{Chat: "MiniMax-M2"}}, "MiniMax-M2", true, false},
+		{"profile override to plain model", core.AgentProfile{Owner: "alice", Model: core.ModelRoute{Chat: "plain-model"}}, "plain-model", false, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			prof := tc.profile
+			cfg, enabled := factory(&squadProfileRunCtx{
+				squadRunCtx: &squadRunCtx{run: core.Run{ID: "run_rules", Owner: "alice"}, eff: eff},
+				prof:        prof,
+			})
+			if !enabled {
+				t.Fatal("factory disabled for a configured run")
+			}
+			if cfg.DefaultModel != tc.model {
+				t.Fatalf("model = %q, want %q", cfg.DefaultModel, tc.model)
+			}
+			if cfg.Client.ReasoningSplit != tc.wantSplit {
+				t.Fatalf("reasoning split = %v, want %v", cfg.Client.ReasoningSplit, tc.wantSplit)
+			}
+			if (cfg.Client.RouteContract != nil) != tc.wantContract {
+				t.Fatalf("route contract = %+v, want attached=%v", cfg.Client.RouteContract, tc.wantContract)
+			}
+			// 逐字段等于直连路径同一快照构造出的客户端。
+			direct := runtime.OpenRouteClient(runtime.ResolveChatModel(prof, eff), eff)
+			if cfg.Client.BaseURL != direct.BaseURL || cfg.Client.APIKey != direct.APIKey ||
+				cfg.Client.ReasoningSplit != direct.ReasoningSplit {
+				t.Fatalf("squad client %+v differs from the direct-path client %+v", cfg.Client, direct)
+			}
+			if (cfg.Client.RouteContract == nil) != (direct.RouteContract == nil) {
+				t.Fatalf("contract decision differs from the direct path: squad=%v direct=%v",
+					cfg.Client.RouteContract, direct.RouteContract)
+			}
+		})
+	}
+}
+
+// 宿主没有 Settings 端口（旧骨架/测试桩）时仍按默认账号快照装配，行为不变。
+func TestSquadNativeOptionsFallsBackToDefaultAccountSnapshot(t *testing.T) {
+	_, svc := squadStore(t)
+	if err := svc.MergeSystem(map[string]any{"models": map[string]any{"chat": map[string]any{
+		"model": "default-account-model", "baseUrl": "https://default.invalid/v1", "apiKey": "sk-default-synthetic",
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+	factory := squadAgentNativeFactory(squadNativeDeps{set: svc, secrets: squadSecretStub{}})
+	for name, eff := range map[string]core.EffectiveSettings{
+		"nil snapshot":         nil,
+		"empty snapshot":       {},
+		"settings without run": {"models": map[string]any{"chat": map[string]any{"model": "snapshot-model", "baseUrl": "https://snapshot.invalid/v1"}}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			cfg, enabled := factory(&squadRunCtx{run: core.Run{ID: "run_default", Owner: store.OwnerDefault}, eff: eff})
+			if !enabled {
+				t.Fatal("default-config run stopped working")
+			}
+			want := "snapshot-model"
+			wantBase := "https://snapshot.invalid/v1"
+			if len(eff) == 0 {
+				want, wantBase = "default-account-model", "https://default.invalid/v1"
+			}
+			if cfg.DefaultModel != want || cfg.Client.BaseURL != wantBase {
+				t.Fatalf("route = %q/%q, want %q/%q", cfg.DefaultModel, cfg.Client.BaseURL, want, wantBase)
+			}
+		})
+	}
+	// 没有快照来源也没有默认账号配置时保持未启用（不阻塞产品）。
+	if _, enabled := squadAgentNativeFactory(squadNativeDeps{})(&squadRunCtx{run: core.Run{ID: "run_none"}}); enabled {
+		t.Fatal("factory reported enabled without any configuration source")
+	}
+}

internal/app/squad_native.go

@@ -0,0 +1,149 @@
+// 小队 agent-native 内核工厂的装配（组合根注入 squadadapter.AgentNativeOptions）。
+//
+// 配置解析的硬约束（KTD3 / 审计 F13）：内核用的模型、端点、密钥必须整条来自
+// 「本次运行」的生效快照——rc.Settings() 已按 run.Owner + run.ProjectID 合并，
+// 画像模型覆盖叠加其上，per-route 规则（reasoning split / 受限 EOF 契约）由
+// runtime.OpenRouteClient 与直连路径同一函数判定。不得在这里按默认账号重新
+// 解析：那会把一个用户的模型名和另一个账号的端点/密钥拼在一起。
+package app
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"agent-native/runtime/checkpoint"
+	agentllm "agent-native/runtime/llm"
+	agentmcp "agent-native/runtime/mcp"
+	"agent-native/runtime/policy"
+	agenttools "agent-native/runtime/tools"
+	nativeadp "agent-squad/adapters/native"
+	"agent-system-backend/internal/runtime"
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/squadadapter"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/internal/tools"
+	core "agent-system-core"
+)
+
+// squadNativeDeps 是内核工厂的依赖。mcp 与 pluginMCP 取函数而非值：插件宿主在
+// Run 晚些时候才装配，工厂必须按调用时读，不能把启动期的空值固化进去。
+type squadNativeDeps struct {
+	// set 提供回落快照：宿主没有 Settings 端口时（骨架/旧宿主）才用默认账号。
+	set *settings.Service
+	// secrets 是受管密钥来源（Tavily 池）。
+	secrets activeSecretSource
+	// skillsRoot 是交付配方技能根。
+	skillsRoot string
+	trace      func(name string, attrs map[string]string) func()
+	mcp        func(raw, overrides string) *agentmcp.Manager
+	pluginMCP  func() []core.PluginMCPServer
+}
+
+// squadAgentNativeFactory 返回注入 squadadapter.AgentNativeOptions 的工厂。
+// 主模型未配置时返回未启用（不阻塞产品）；其余装配对每次运行重新解析。
+func squadAgentNativeFactory(deps squadNativeDeps) func(squadadapter.Ctx) (nativeadp.Config, bool) {
+	return func(rc squadadapter.Ctx) (nativeadp.Config, bool) {
+		// 当前运行的用户/项目快照；宿主无 Settings 端口时才回落默认账号。
+		effNow, ok := runtime.RunEffectiveSettings(rc)
+		if !ok {
+			if deps.set == nil {
+				return nativeadp.Config{}, false
+			}
+			effNow = deps.set.Effective(store.OwnerDefault, "")
+		}
+		// 画像模型覆盖走同一条解析规则（Owner 决定密钥层归属）。
+		route := runtime.ResolveChatModel(runtime.RunProfile(rc), effNow)
+		if route.Model == "" || route.Base == "" {
+			return nativeadp.Config{}, false
+		}
+		mode := "default"
+		if src, ok := rc.(interface{ PermissionMode() string }); ok {
+			mode = src.PermissionMode()
+		}
+		cfg := nativeadp.Config{
+			Client:       runtime.OpenRouteClient(route, effNow),
+			DefaultModel: route.Model,
+			MaxTurns:     0,
+			Timeout:      0,
+			Subagent:     squadadapter.SubagentFactory(rc),
+			RepeatGuard:  true,
+			BeforeTool: func(call agentllm.ToolCall) error {
+				effect := policy.Decide(policy.Request{
+					Mode: policy.Normalize(mode), Name: call.Name, Args: call.Arguments,
+					Traits: policy.TraitsFor(call.Name),
+				}, nil)
+				if effect == policy.EffectDeny {
+					return fmt.Errorf("计划模式拒绝了工具 %s", call.Name)
+				}
+				return nil
+			},
+		}
+		cfg.Stream = runtime.GuardProjectStream(rc, "", cfg.Client.Stream)
+		var keys []string
+		if deps.secrets != nil {
+			keys = tavilyKeyPool(deps.secrets, effNow.GetString("tools.tavily.apiKeys", ""))
+		}
+		if len(keys) > 0 {
+			cfg.Search = agenttools.NewTavilyProvider(effNow.GetString("tools.tavily.endpoint", ""), keys)
+		}
+		if effNow.GetBool("runtime.exec", true) {
+			cfg.Exec = tools.InterpreterExecConfig()
+		}
+		if st2, err := os.Stat(deps.skillsRoot); err == nil && st2.IsDir() {
+			cfg.SkillsRoots = []string{deps.skillsRoot}
+		}
+		rawMCP := strings.TrimSpace(effNow.GetString("tools.mcp.servers", ""))
+		if deps.pluginMCP != nil {
+			rawMCP = mergeMCPServers(rawMCP, deps.pluginMCP())
+		}
+		if deps.mcp != nil {
+			if mgr := deps.mcp(rawMCP, strings.TrimSpace(effNow.GetString("tools.mcp.overrides", ""))); mgr != nil {
+				cfg.MCP = mgr
+			}
+		}
+		// Native squad tools do not yet expose a fail-closed result hook to the
+		// project observation outbox. Project runs therefore use the audited
+		// runCtx retrieval/tool path only; enabling these direct providers would
+		// let their results reach the next model turn without source analysis.
+		if rc.Run().ProjectID != "" {
+			cfg.Search = nil
+			cfg.Exec = nil
+			cfg.Fetch = nil
+			cfg.MCP = nil
+		}
+		cfg.CodeOrchestration = rc.Run().ProjectID == "" && effNow.GetBool("runtime.codeOrchestration", false)
+		if ask, ok := rc.(interface {
+			AskUser(card core.HITLCard) (core.HITLResponse, error)
+		}); ok {
+			cfg.Ask = func(_ context.Context, question string) (string, error) {
+				resp, err := ask.AskUser(core.HITLCard{
+					Question: question, Kind: core.HITLKindInput, AllowFreeInput: true,
+				})
+				if err != nil {
+					return "", err
+				}
+				if strings.TrimSpace(resp.FreeText) != "" {
+					return strings.TrimSpace(resp.FreeText), nil
+				}
+				return resp.ChoiceID, nil
+			}
+		}
+		cfg.Trace = deps.trace
+		// N1 WP4：小队成员的内核 ask 决策经 GateOptions.PermissionAsk 到达
+		// runCtx 的 HITL 确认卡（宿主无实现则 nil，内核保持 ask=拒绝旧行为）。
+		cfg.PermissionAsk = runtime.PermissionAskOf(rc)
+		if host, ok := rc.(interface {
+			OpenCheckpoints() (*checkpoint.Log, error)
+			CheckpointAnchor() string
+		}); ok {
+			if lg, err := host.OpenCheckpoints(); err == nil {
+				cfg.Checkpoints = lg
+				anchor := host.CheckpointAnchor()
+				cfg.CheckpointAnchor = func() string { return anchor }
+			}
+		}
+		return cfg, true
+	}
+}

internal/cmdbus/account_write_fence_test.go

@@ -2,7 +2,10 @@ package cmdbus
 
 import (
 	"context"
+	"errors"
+	"strings"
 	"testing"
+	"time"
 
 	agentcommand "agent-command"
 )
@@ -16,3 +19,46 @@ func TestStrictAccountWritesRejectLegacyBusPorts(t *testing.T) {
 		t.Fatalf("legacy port wrote under strict mode: %+v, cards=%d audit=%d pending=%d", resp.Receipt, len(cards.created), len(audit.logs), len(b.pending))
 	}
 }
+
+// fencedAuditStore 是"账号围栏内审计落盘失败"的替身：围栏写路径已经跑完，
+// 只有审计行写不进去（围栏内审计失败＝结果不确定，不是"什么都没发生"）。
+type fencedAuditStore struct{ appends int }
+
+func (f *fencedAuditStore) AppendAudit(string, agentcommand.AuditEnvelope) error {
+	f.appends++
+	return errors.New("audit fenced")
+}
+
+func (f *fencedAuditStore) AppendAuditAccountChecked(string, agentcommand.AuditEnvelope, bool) error {
+	f.appends++
+	return errors.New("audit fenced")
+}
+
+// TestStrictAccountWriteAuditLossKeepsOperationID：围栏档下 handler 已提交、
+// 审计写失败时，回执仍是 unknown 且带上 handler 拿到的 operationID，
+// 调用方才能在围栏外按记录对账（F10 Bug 2 在围栏路径上的同一语义）。
+func TestStrictAccountWriteAuditLossKeepsOperationID(t *testing.T) {
+	audit := &fencedAuditStore{}
+	b := New(audit, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	b.RequireAccountCheckedWrites(true)
+	var seen string
+	if err := b.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.fenced", Title: "围栏写入"}, "", func(_ context.Context, req Request) (any, error) {
+		seen = req.OperationID
+		return "written", nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp := b.Dispatch(context.Background(), Request{ID: "demo.fenced", Owner: "alice", Actor: "alice"})
+	if resp.Receipt.State != agentcommand.StateUnknown || !strings.Contains(resp.Receipt.Reason, "audit unavailable") {
+		t.Fatalf("fenced audit loss must stay unknown: %+v", resp.Receipt)
+	}
+	if seen == "" || resp.Receipt.OperationID != seen {
+		t.Fatalf("fenced audit loss dropped the reconciliation handle: receipt=%q handler=%q", resp.Receipt.OperationID, seen)
+	}
+	if resp.Receipt.SideEffects != agentcommand.SideEffectsPossible || resp.Receipt.Validate() != nil {
+		t.Fatalf("fenced receipt must declare possible side effects and validate: %+v", resp.Receipt)
+	}
+	if audit.appends != 1 {
+		t.Fatalf("account-checked audit appends = %d, want 1", audit.appends)
+	}
+}

internal/cmdbus/cmdbus.go

@@ -26,6 +26,43 @@ type AuditStore interface {
 	AppendAudit(owner string, env agentcommand.AuditEnvelope) error
 }
 
+// OperationRecord 是"已记录操作"的最小对账投影（R7/KTD6）。它回答的是
+// “这个 operationID 在本 owner/project 名下到底是什么结果”，而不是重放入口。
+// 刻意保持最小：审计信封只存状态与标识，不存理由文本，所以这里没有 Reason——
+// 不为不存在的字段留位置。
+type OperationRecord struct {
+	OperationID string
+	CommandID   string
+	State       agentcommand.ResultState
+	Time        time.Time
+}
+
+// OperationQuery 是 operationID 的对账查询端口（组合根装配；nil = 不提供）。
+//
+// 授权口径：owner 与 projectID 都是可信过滤条件，实现必须把它们放进查询谓词
+// （SQL 的 owner/project 等值条件），不得由调用方参数扩大可见范围；查不到就
+// 返回 not found，不得回退为“未执行”。
+//
+// 诚实边界：本端口只解析“已经落成记录”的 operation。宿主侧的命令回执记录就是
+// 命令审计信封（command_audit 按 owner+project 归属）；handler 自己的领域操作表
+// （如文档投递 document_render_deliveries）由各自领域查询负责，不经本端口。某些
+// 命令根本不持久化 req.OperationID（内置的 builtin.help、runtime.mock、
+// models.set、conversation.profile、conversation.create 都是无操作表的即时用例），
+// 对它们的 operationID 查询恒为 not found——这类命令只能按领域资源（会话、画像、
+// 设置项）对账，不得声称可按 operationID 查询。
+type OperationQuery interface {
+	LookupOperation(owner, projectID, operationID string) (OperationRecord, bool, error)
+}
+
+var (
+	// ErrOperationScope 缺少可信 owner/project/operation 作用域：fail-closed，无作用域即无可见性。
+	ErrOperationScope = errors.New("cmdbus: operation lookup requires owner, project and operation scope")
+	// ErrOperationNotRecorded 该作用域内没有此 operation 的记录（未记录 ≠ 未执行）。
+	ErrOperationNotRecorded = errors.New("cmdbus: no operation record in this owner and project scope")
+	// ErrOperationQueryUnavailable 组合根未装配对账查询端口。
+	ErrOperationQueryUnavailable = errors.New("cmdbus: operation query unavailable")
+)
+
 // CardPort 确认卡所需卡片能力（cardsvc.Service 实现）。
 type CardPort interface {
 	Create(owner string, card core.ActivityCard, ref string) (core.ActivityCard, error)
@@ -35,6 +72,39 @@ type CardPort interface {
 // Handler 宿主执行适配器：同步内置用例返回 payload；异步执行自行返回 accepted 回执。
 type Handler func(ctx context.Context, req Request) (any, error)
 
+// ErrNotExecuted 标记"失败确定发生在任何副作用之前"的 handler 错误（F10/U7b）。
+// 语义口径：只有带此标记的错误才可归 rejected（确定未执行、无副作用、回执不得
+// 携带 operationID）；未标记的 handler 错误一律按"已执行随后不确定"归 unknown，
+// 并带上本次分发已签发的 trusted operation ID 交由对账收敛。宿主不得据
+// "处理方报了错"臆断未执行——那会把已写库的操作诱使成不安全重试。
+//
+// 进程内插件（pkg/extension.Handler）当前还没有等价的声明位：插件命令的
+// handler 错误一律按 unknown 对账，直到扩展面补上对应标记为止。
+var ErrNotExecuted = errors.New("cmdbus: not executed")
+
+// NotExecutedError 是带"确定未执行"声明的错误包装。Error() 保留原始文案
+// （回执 reason 不因标记而变形），Unwrap/Is 让 errors.Is 同时匹配
+// ErrNotExecuted 与被包装的原始错误。
+type NotExecutedError struct{ Err error }
+
+func (e *NotExecutedError) Error() string { return e.Err.Error() }
+func (e *NotExecutedError) Unwrap() error { return e.Err }
+func (e *NotExecutedError) Is(target error) bool {
+	return target == ErrNotExecuted
+}
+
+// NotExecuted 声明该失败确定未执行（校验/权限/确认缺失/领域事务回滚等任何
+// 副作用之前的拒绝）。nil 原样返回；重复标记幂等。
+func NotExecuted(err error) error {
+	if err == nil || IsNotExecuted(err) {
+		return err
+	}
+	return &NotExecutedError{Err: err}
+}
+
+// IsNotExecuted 报告该错误是否声明了"确定未执行"。
+func IsNotExecuted(err error) bool { return errors.Is(err, ErrNotExecuted) }
+
 // CommandTool EXT-14：带 exposeAsTool 声明的命令的工具投影视图（runmgr 消费）。
 // Risk 取 low|medium|high（工具权限声明口径）；ID 即工具名（命令 id）。
 type CommandTool struct {
@@ -171,12 +241,24 @@ type Bus struct {
 	strictAccountWrites  bool
 	allowImplicitLocal   bool
 	projectWorkPreflight func(context.Context, Request) error
+	hostProjectGuard     func(context.Context, Request) error
+	// operationQuery operationID 对账查询端口（nil = 不提供，见 OperationQuery）。
+	operationQuery OperationQuery
 }
 
 func (b *Bus) SetProjectWorkPreflight(fn func(context.Context, Request) error) {
 	b.projectWorkPreflight = fn
 }
 
+// SetHostProjectGuard installs the composition-root check applied to every
+// dispatch that carries a base project, before the project-work preflight and
+// before any handler runs. It is the single bus-level place where host-project
+// capability gates live, so every entrance (slash, exec, chat intent routing,
+// system.intent re-dispatch, agent tool) is covered by one decision.
+func (b *Bus) SetHostProjectGuard(fn func(context.Context, Request) error) {
+	b.hostProjectGuard = fn
+}
+
 // PendingStore 把危险命令的确认挂起态落盘。进程内 map 仍是热路径；重启后从存储取回。
 type PendingStore interface {
 	SavePendingConfirm(cardID, owner, payload string) error
@@ -200,6 +282,33 @@ func (b *Bus) Registry() *agentcommand.Registry { return b.reg }
 // SetPendingStore 注入确认挂起态的持久化实现（nil = 仅进程内）。
 func (b *Bus) SetPendingStore(st PendingStore) { b.pendingStore = st }
 
+// SetOperationQuery 装配 operationID 对账查询端口（组合根；启动期一次）。
+func (b *Bus) SetOperationQuery(q OperationQuery) { b.operationQuery = q }
+
+// LookupOperation 按 owner/project 作用域查一个已记录 operation 的当前状态
+// （R7/KTD6）。这是 unknown 回执的对账入口：拿到 operationID 的调用方先查
+// 记录，再决定下一步，而不是重发命令。
+//
+// 三重 fail-closed：作用域任一为空即拒（不猜、不按 owner=“”放行）、未装配端口
+// 即拒、查不到即 ErrOperationNotRecorded（不推断“未执行”）。跨 owner 查询由
+// 端口的 owner 等值谓词拒绝——本层只把 owner 当可信条件往下传。
+func (b *Bus) LookupOperation(owner, projectID, operationID string) (OperationRecord, error) {
+	if owner == "" || projectID == "" || operationID == "" {
+		return OperationRecord{}, ErrOperationScope
+	}
+	if b.operationQuery == nil {
+		return OperationRecord{}, ErrOperationQueryUnavailable
+	}
+	record, found, err := b.operationQuery.LookupOperation(owner, projectID, operationID)
+	if err != nil {
+		return OperationRecord{}, err
+	}
+	if !found || record.OperationID == "" {
+		return OperationRecord{}, ErrOperationNotRecorded
+	}
+	return record, nil
+}
+
 // SetEffectiveAccountGuard installs the composition-root check at startup.
 // Handler Store writes still need their own final transaction fence.
 func (b *Bus) SetEffectiveAccountGuard(g EffectiveAccountGuard) { b.accountGuard = g }
@@ -382,6 +491,13 @@ func (b *Bus) Dispatch(ctx context.Context, req Request) Response {
 	if err := validateParams(spec.ParamsSchema, req.Params); err != nil {
 		return receipt(agentcommand.StateRejected, "", "params: "+err.Error())
 	}
+	// 基座项目门禁：所有带 HostProjectID 的分发都在这里过一道，命令种类与宿主
+	// 能力的匹配面由组合根决定（nil 时保持原行为）。
+	if req.HostProjectID != "" && b.hostProjectGuard != nil {
+		if err := b.hostProjectGuard(ctx, req); err != nil {
+			return receipt(agentcommand.StateRejected, "", "host project: "+err.Error())
+		}
+	}
 	if RequiresProjectWorkDecision(req.ID) {
 		if b.projectWorkPreflight == nil {
 			return receipt(agentcommand.StateRejected, "", "project source preflight unavailable")
@@ -405,10 +521,12 @@ func (b *Bus) Dispatch(ctx context.Context, req Request) Response {
 		if b.pendingStore != nil {
 			raw, _ := json.Marshal(req)
 			if err := b.savePending(card.ID, accountActor(req), string(raw)); err != nil {
-				return receipt(agentcommand.StateUnknown, "", "confirm pending: "+err.Error())
+				// 确认卡已创建（副作用已发生），挂起态却没落库：结果不确定，且
+				// 卡 ID 就是本次受理的操作标识——随 unknown 一并给出，供对账。
+				return receipt(agentcommand.StateUnknown, card.ID, "confirm pending: "+err.Error())
 			}
 		} else if b.strictAccountWrites {
-			return receipt(agentcommand.StateUnknown, "", "confirm pending: account-checked store required")
+			return receipt(agentcommand.StateUnknown, card.ID, "confirm pending: account-checked store required")
 		}
 		b.pendMu.Lock()
 		b.pending[card.ID] = pending{req: req, cardID: card.ID}
@@ -425,7 +543,9 @@ func (b *Bus) Dispatch(ctx context.Context, req Request) Response {
 	}
 	// The domain handler can persist this trusted ID with its transaction/outbox.
 	// Entropy, not the clock or caller Params, distinguishes concurrent operations.
-	// A handler failure still writes only a rejected audit receipt without an ID.
+	// A handler error keeps the ID only on the "executed then uncertain" path
+	// (unknown): rejected must never carry one, and unknown without a queryable
+	// handle would be a dead end for reconciliation.
 	var opBytes [24]byte
 	if _, err := rand.Read(opBytes[:]); err != nil {
 		return receipt(agentcommand.StateUnknown, "", "operation ID unavailable")
@@ -433,11 +553,26 @@ func (b *Bus) Dispatch(ctx context.Context, req Request) Response {
 	req.OperationID = "op_" + hex.EncodeToString(opBytes[:])
 	payload, err := h(ctx, req)
 	if err != nil {
-		return receipt(agentcommand.StateRejected, "", "rejected: "+err.Error())
+		if IsNotExecuted(err) {
+			// handler 声明失败发生在任何副作用之前：确定未执行，可安全归
+			// rejected（回执契约禁止 rejected 携带 operationID）。
+			return receipt(agentcommand.StateRejected, "", "rejected: "+err.Error())
+		}
+		// handler 已开始执行才报错：宿主无法断言"无副作用"（F10）。按"已执行
+		// 随后不确定"归 unknown，并带上本次分发已签发的 trusted operation ID，
+		// 调用方据此按记录对账，而不是盲目重试。本路径不做任何自动重放。
+		return b.unknownAfterExecution(req, "handler failed after execution began: "+err.Error(), start)
 	}
 	return Response{Receipt: b.auditReceipt(req, agentcommand.StateCommitted, req.OperationID, "", start), Payload: payload}
 }
 
+// unknownAfterExecution 记录并返回"已执行随后不确定"的回执（F10/U7b）：审计
+// 信封带 state=unknown 与已签发的 operationID（可查凭证），回执走库内受信
+// 构造器 NewUnknownAfterExecution，保证 Validate() 通过且对账句柄不丢。
+func (b *Bus) unknownAfterExecution(req Request, reason string, start time.Time) Response {
+	return Response{Receipt: b.auditReceipt(req, agentcommand.StateUnknown, req.OperationID, reason, start)}
+}
+
 // Confirm 确认卡回道：actionID=confirm 执行挂起请求（entrance 归一 card），其余视为取消。
 func (b *Bus) Confirm(owner, cardID, actionID string) Response {
 	return b.ConfirmContext(context.Background(), owner, cardID, actionID)
@@ -456,7 +591,7 @@ func (b *Bus) ConfirmContext(ctx context.Context, owner, cardID, actionID string
 	p, ok := b.pending[cardID]
 	b.pendMu.Unlock()
 	if ok && p.req.Owner != "" && p.req.Owner != owner {
-		return Response{Receipt: agentcommand.ExecReceipt{CommandID: p.req.ID, State: agentcommand.StateRejected, Reason: "confirm owner mismatch", Time: b.now().UTC()}}
+		return Response{Receipt: agentcommand.ExecReceipt{CommandID: p.req.ID, State: agentcommand.StateRejected, Reason: "confirm owner mismatch", SideEffects: agentcommand.SideEffectsNone, Time: b.now().UTC()}}
 	}
 	if b.pendingStore != nil {
 		storedOwner, payload, found, err := b.takePending(cardID, owner)
@@ -466,7 +601,7 @@ func (b *Bus) ConfirmContext(ctx context.Context, owner, cardID, actionID string
 		if found {
 			var req Request
 			if storedOwner != owner || json.Unmarshal([]byte(payload), &req) != nil {
-				return Response{Receipt: agentcommand.ExecReceipt{CommandID: "unknown", State: agentcommand.StateRejected, Reason: "invalid pending confirm", Time: b.now().UTC()}}
+				return Response{Receipt: agentcommand.ExecReceipt{CommandID: "unknown", State: agentcommand.StateRejected, Reason: "invalid pending confirm", SideEffects: agentcommand.SideEffectsNone, Time: b.now().UTC()}}
 			}
 			p = pending{req: req, cardID: cardID}
 			ok = true
@@ -477,11 +612,11 @@ func (b *Bus) ConfirmContext(ctx context.Context, owner, cardID, actionID string
 		ok = false
 	}
 	if !ok {
-		return Response{Receipt: agentcommand.ExecReceipt{CommandID: "unknown", State: agentcommand.StateRejected, Reason: "no pending confirm (expired or already resolved)", Time: b.now().UTC()}}
+		return Response{Receipt: agentcommand.ExecReceipt{CommandID: "unknown", State: agentcommand.StateRejected, Reason: "no pending confirm (expired or already resolved)", SideEffects: agentcommand.SideEffectsNone, Time: b.now().UTC()}}
 	}
 	req := p.req
 	if req.Owner != "" && req.Owner != owner {
-		return Response{Receipt: agentcommand.ExecReceipt{CommandID: req.ID, State: agentcommand.StateRejected, Reason: "confirm owner mismatch", Time: b.now().UTC()}}
+		return Response{Receipt: agentcommand.ExecReceipt{CommandID: req.ID, State: agentcommand.StateRejected, Reason: "confirm owner mismatch", SideEffects: agentcommand.SideEffectsNone, Time: b.now().UTC()}}
 	}
 	b.pendMu.Lock()
 	delete(b.pending, cardID)
@@ -497,15 +632,29 @@ func (b *Bus) ConfirmContext(ctx context.Context, owner, cardID, actionID string
 	}
 	resp := b.Dispatch(ctx, req)
 	if b.cards != nil {
-		if resp.Receipt.State == agentcommand.StateCommitted {
+		switch resp.Receipt.State {
+		case agentcommand.StateCommitted:
 			_, _ = b.setConfirmCardStatus(owner, cardID, core.CardResolved, "ok", "confirmed")
-		} else {
+		case agentcommand.StateUnknown:
+			// 已执行随后不确定：卡片必须落到终态（悬在 action_required 会诱导
+			// 二次确认，而挂起项已被消费，重放只会得到"已解决"），但不得断言
+			// 失败——tone 用 warn，note 写明不确定原因与对账用 operationID。
+			_, _ = b.setConfirmCardStatus(owner, cardID, core.CardFailed, "warn", uncertainNote(resp.Receipt))
+		default:
 			_, _ = b.setConfirmCardStatus(owner, cardID, core.CardFailed, "danger", resp.Receipt.Reason)
 		}
 	}
 	return resp
 }
 
+// uncertainNote 组成"结果未知"卡片的说明：不确定原因 + 对账句柄。
+func uncertainNote(r agentcommand.ExecReceipt) string {
+	if r.OperationID == "" {
+		return r.Reason
+	}
+	return r.Reason + " (operation " + r.OperationID + ")"
+}
+
 func accountActor(req Request) string {
 	// Plugin and delegated commands use Actor for an audit label such as a
 	// plugin ID; Owner is the effective account whose state controls effects.
@@ -528,7 +677,7 @@ func (b *Bus) checkEffectiveAccount(ctx context.Context, actor string) error {
 func (b *Bus) accountRejected(commandID string, start time.Time) Response {
 	return Response{Receipt: agentcommand.ExecReceipt{
 		CommandID: commandID, State: agentcommand.StateRejected,
-		Reason: "effective account unavailable", Time: start.UTC(),
+		Reason: "effective account unavailable", SideEffects: agentcommand.SideEffectsNone, Time: start.UTC(),
 	}}
 }
 
@@ -555,10 +704,37 @@ func (b *Bus) auditReceipt(req Request, state agentcommand.ResultState, op, reas
 		err = b.audit.AppendAudit(req.Owner, env)
 	}
 	if err != nil {
-		// 审计不可用：结果标记未知，不臆断成功（四态语义）。
-		return agentcommand.ExecReceipt{CommandID: req.ID, State: agentcommand.StateUnknown, Reason: "audit unavailable: " + err.Error(), Time: b.now().UTC()}
+		// 审计不可用：结果标记未知，不臆断成功（四态语义）。已经签发过操作标识的
+		// 路径（committed/accepted/已执行后不确定）连同该标识一并返回——信封丢失
+		// 不等于操作没发生，调用方仍需按 operationID 对账；确定未执行的路径不带
+		// 标识（rejected 契约禁止带 ID，unknown 无 ID 时也无需对账）。
+		return unknownReceipt(req.ID, state, op, "audit unavailable: "+err.Error(), b.now().UTC())
 	}
-	return agentcommand.ExecReceipt{CommandID: req.ID, State: state, OperationID: op, Reason: reason, Time: b.now().UTC()}
+	if state == agentcommand.StateUnknown && op != "" {
+		// 已执行随后不确定：只有库内受信构造器允许 unknown 携带本流程签发的 ID。
+		return agentcommand.NewUnknownAfterExecution(req.ID, op, reason, b.now().UTC())
+	}
+	return agentcommand.ExecReceipt{CommandID: req.ID, State: state, OperationID: op, Reason: reason,
+		SideEffects: sideEffectsFor(state), Time: b.now().UTC()}
+}
+
+// unknownReceipt 构造"结果未知"回执：已签发过操作标识时走受信构造器携带该标识
+// （供对账），否则返回不带标识的 unknown。state=rejected 恒不带标识。
+func unknownReceipt(commandID string, state agentcommand.ResultState, op, reason string, at time.Time) agentcommand.ExecReceipt {
+	if op != "" && state != agentcommand.StateRejected {
+		return agentcommand.NewUnknownAfterExecution(commandID, op, reason, at)
+	}
+	return agentcommand.ExecReceipt{CommandID: commandID, State: agentcommand.StateUnknown, Reason: reason, Time: at}
+}
+
+// sideEffectsFor 回执的副作用声明：总线自身发起的 rejected 均为任何副作用之前
+// 的拒绝（未知命令/参数校验/项目前置/账号预检/无处理器/确认取消/handler 声明的
+// not-executed），故断言 none；committed/accepted 维持今日语义（未声明）。
+func sideEffectsFor(state agentcommand.ResultState) agentcommand.SideEffects {
+	if state == agentcommand.StateRejected {
+		return agentcommand.SideEffectsNone
+	}
+	return agentcommand.SideEffectsUnset
 }
 
 func digest(params map[string]any) string {

internal/cmdbus/cmdbus_test.go

@@ -52,7 +52,8 @@ func newTestBus(a AuditStore, c CardPort) *Bus {
 	}, "/risky", func(ctx context.Context, req Request) (any, error) {
 		t, _ := req.Params["target"].(string)
 		if t == "boom" {
-			return nil, errors.New("handler rejected")
+			// 参数级拒绝发生在任何副作用之前：显式声明 not-executed（F10）。
+			return nil, NotExecuted(errors.New("handler rejected"))
 		}
 		return map[string]any{"did": t}, nil
 	})
@@ -106,13 +107,20 @@ func TestHandlerReceivesCommittedOperationIDBeforeDomainWrite(t *testing.T) {
 		if req.OperationID == "" {
 			t.Fatal("handler must receive a tentative host operation ID")
 		}
-		return nil, errors.New("domain transaction rejected")
+		// 领域事务回滚 = 确定未执行：声明 not-executed 才是 rejected 的依据。
+		return nil, NotExecuted(errors.New("domain transaction rejected"))
 	}); err != nil {
 		t.Fatal(err)
 	}
 	failed := bus.Dispatch(context.Background(), Request{ID: "rdm.fail", Actor: "alice", Owner: "alice"})
 	if failed.Receipt.State != agentcommand.StateRejected || failed.Receipt.OperationID != "" || len(audit.logs) != 2 || audit.logs[1].OperationID != "" {
-		t.Fatalf("failed handler was marked committed: %+v audits=%+v", failed.Receipt, audit.logs)
+		t.Fatalf("not-executed handler was not rejected: %+v audits=%+v", failed.Receipt, audit.logs)
+	}
+	if err := failed.Receipt.Validate(); err != nil {
+		t.Fatalf("rejected receipt must satisfy the library contract: %v", err)
+	}
+	if failed.Receipt.SideEffects != agentcommand.SideEffectsNone {
+		t.Fatalf("rejected receipt must declare no side effects, got %q", failed.Receipt.SideEffects)
 	}
 }
 
@@ -342,3 +350,248 @@ func TestHighDangerPluginCommandConfirmsFirst(t *testing.T) {
 		t.Fatalf("confirm: %+v executed=%d", resp2.Receipt, executed)
 	}
 }
+
+// ---- F10/U7b：确定未执行 vs 已执行后不确定 + operationID 对账 ----
+
+// memOperationQuery 是按 owner/project 等值谓词过滤的操作记录替身（模拟 SQL
+// 作用域）：跨 owner 或跨 project 的 operationID 一律查不到。
+type memOperationQuery struct {
+	records map[string]OperationRecord // key: owner|projectID|operationID
+}
+
+func operationKey(owner, projectID, operationID string) string {
+	return owner + "|" + projectID + "|" + operationID
+}
+
+func (q *memOperationQuery) LookupOperation(owner, projectID, operationID string) (OperationRecord, bool, error) {
+	rec, ok := q.records[operationKey(owner, projectID, operationID)]
+	return rec, ok, nil
+}
+
+// recordAudit 把总线真实落下的审计信封登记为可查操作记录（对齐"审计信封就是
+// 宿主侧操作记录"的口径），用于验证 unknown 回执给出的对账句柄真的查得到。
+func (q *memOperationQuery) recordAudit(owner, projectID string, env agentcommand.AuditEnvelope) {
+	if env.OperationID == "" {
+		return
+	}
+	q.records[operationKey(owner, projectID, env.OperationID)] = OperationRecord{
+		OperationID: env.OperationID, CommandID: env.CommandID, State: env.State, Time: env.Time,
+	}
+}
+
+// TestHandlerErrorAfterStoreWriteIsUnknownWithOperationID 是 F10 的核心回归：
+// handler 已经写库、之后才失败时，回执必须是 unknown 且携带它拿到的
+// operationID，理由点明"执行开始后失败"，绝不退化成 rejected（会诱发不安全重试）。
+func TestHandlerErrorAfterStoreWriteIsUnknownWithOperationID(t *testing.T) {
+	audit := &memAudit{}
+	bus := New(audit, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	var writes []string
+	var seen string
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.write", Title: "写入"}, "", func(_ context.Context, req Request) (any, error) {
+		seen = req.OperationID
+		writes = append(writes, req.OperationID) // 副作用已发生
+		return nil, errors.New("commit acknowledgement lost")
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp := bus.Dispatch(context.Background(), Request{ID: "demo.write", Actor: "alice", Owner: "alice"})
+	if resp.Receipt.State != agentcommand.StateUnknown {
+		t.Fatalf("post-execution failure must not be reported as rejected: %+v", resp.Receipt)
+	}
+	if seen == "" || resp.Receipt.OperationID != seen {
+		t.Fatalf("unknown receipt lost the reconciliation handle: receipt=%q handler=%q", resp.Receipt.OperationID, seen)
+	}
+	if !strings.Contains(resp.Receipt.Reason, "after execution began") {
+		t.Fatalf("reason must name post-execution uncertainty: %q", resp.Receipt.Reason)
+	}
+	if resp.Receipt.SideEffects != agentcommand.SideEffectsPossible {
+		t.Fatalf("side effects = %q, want %q", resp.Receipt.SideEffects, agentcommand.SideEffectsPossible)
+	}
+	if err := resp.Receipt.Validate(); err != nil {
+		t.Fatalf("trusted unknown receipt must satisfy the library contract: %v", err)
+	}
+	if len(writes) != 1 {
+		t.Fatalf("handler ran %d times, want 1", len(writes))
+	}
+	// 对账凭证：审计信封落 unknown + 同一个 operationID。
+	if len(audit.logs) != 1 || audit.logs[0].State != agentcommand.StateUnknown || audit.logs[0].OperationID != seen {
+		t.Fatalf("audit envelope is not reconcilable: %+v", audit.logs)
+	}
+	// 宿主不得自动重放：再次分发是一次新操作（新的 operationID），旧的不被复用。
+	again := bus.Dispatch(context.Background(), Request{ID: "demo.write", Actor: "alice", Owner: "alice"})
+	if again.Receipt.State != agentcommand.StateUnknown || again.Receipt.OperationID == resp.Receipt.OperationID || len(writes) != 2 {
+		t.Fatalf("re-dispatch must be a new operation, not a replay: %+v writes=%d", again.Receipt, len(writes))
+	}
+}
+
+// TestHandlerNotExecutedErrorStaysRejected：handler 显式声明未执行才是
+// rejected 的依据；回执不得携带 operationID（库契约）。
+func TestHandlerNotExecutedErrorStaysRejected(t *testing.T) {
+	audit := &memAudit{}
+	bus := New(audit, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	calls := 0
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.guard", Title: "守卫"}, "", func(context.Context, Request) (any, error) {
+		calls++
+		boom := errors.New("permission denied")
+		return nil, NotExecuted(boom)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp := bus.Dispatch(context.Background(), Request{ID: "demo.guard", Owner: "alice", Actor: "alice"})
+	if resp.Receipt.State != agentcommand.StateRejected || resp.Receipt.OperationID != "" {
+		t.Fatalf("not-executed failure must stay rejected without an ID: %+v", resp.Receipt)
+	}
+	if resp.Receipt.Reason != "rejected: permission denied" {
+		t.Fatalf("not-executed marking must not distort the reason: %q", resp.Receipt.Reason)
+	}
+	if resp.Receipt.SideEffects != agentcommand.SideEffectsNone || resp.Receipt.Validate() != nil {
+		t.Fatalf("rejected receipt must declare no side effects and validate: %+v", resp.Receipt)
+	}
+	if calls != 1 || len(audit.logs) != 1 || audit.logs[0].State != agentcommand.StateRejected || audit.logs[0].OperationID != "" {
+		t.Fatalf("unexpected effects: calls=%d audits=%+v", calls, audit.logs)
+	}
+	// 标记语义：errors.Is 同时命中 ErrNotExecuted 与原始错误；nil 幂等。
+	wrapped := NotExecuted(errors.New("boom"))
+	if !IsNotExecuted(wrapped) || !errors.Is(wrapped, ErrNotExecuted) || wrapped.Error() != "boom" {
+		t.Fatalf("not-executed wrapper semantics: %v / %v", wrapped, IsNotExecuted(wrapped))
+	}
+	if NotExecuted(nil) != nil || !IsNotExecuted(NotExecuted(wrapped)) {
+		t.Fatal("not-executed marking must be nil-safe and idempotent")
+	}
+}
+
+// TestCommittedWithAuditFailureKeepsOperationID 是 F10 Bug 2 的回归：审计
+// 落盘失败时回执仍是 unknown，但必须带着已交给 handler 的 operationID，
+// 理由点名审计不可用，调用方才能按记录对账而不是重发。
+func TestCommittedWithAuditFailureKeepsOperationID(t *testing.T) {
+	audit := &memAudit{fail: true}
+	bus := New(audit, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	var seen string
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.ping", Title: "Ping"}, "", func(_ context.Context, req Request) (any, error) {
+		seen = req.OperationID
+		return map[string]any{"pong": true}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp := bus.Dispatch(context.Background(), Request{ID: "demo.ping", Owner: "alice", Actor: "alice"})
+	if resp.Receipt.State != agentcommand.StateUnknown || !strings.Contains(resp.Receipt.Reason, "audit unavailable") {
+		t.Fatalf("audit loss must stay unknown and name the audit: %+v", resp.Receipt)
+	}
+	if seen == "" || resp.Receipt.OperationID != seen {
+		t.Fatalf("audit loss dropped the reconciliation handle: receipt=%q handler=%q", resp.Receipt.OperationID, seen)
+	}
+	if resp.Receipt.SideEffects != agentcommand.SideEffectsPossible || resp.Receipt.Validate() != nil {
+		t.Fatalf("audit-loss receipt must declare possible side effects and validate: %+v", resp.Receipt)
+	}
+	if len(audit.logs) != 0 {
+		t.Fatalf("audit rows written while failing: %+v", audit.logs)
+	}
+	// 校验：未执行路径（rejected）在审计不可用时不得凭空出现 operationID。
+	rejected := bus.Dispatch(context.Background(), Request{ID: "demo.absent"})
+	if rejected.Receipt.OperationID != "" || rejected.Receipt.State != agentcommand.StateUnknown {
+		t.Fatalf("audit loss must not invent an operation ID: %+v", rejected.Receipt)
+	}
+}
+
+// TestValidationRejectionNeverRunsHandler：显式校验拒绝仍是 rejected、无 ID、
+// 无副作用，且 handler 一次都不许跑。
+func TestValidationRejectionNeverRunsHandler(t *testing.T) {
+	audit := &memAudit{}
+	bus := New(audit, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	calls := 0
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{
+		ID: "demo.needs", Title: "需要参数",
+		ParamsSchema: json.RawMessage(`{"type":"object","required":["target"],"properties":{"target":{"type":"string"}}}`),
+	}, "", func(context.Context, Request) (any, error) {
+		calls++
+		return "ran", nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp := bus.Dispatch(context.Background(), Request{ID: "demo.needs", Owner: "alice", Params: map[string]any{}})
+	if resp.Receipt.State != agentcommand.StateRejected || resp.Receipt.OperationID != "" || resp.Receipt.Validate() != nil {
+		t.Fatalf("validation rejection: %+v", resp.Receipt)
+	}
+	if resp.Receipt.SideEffects != agentcommand.SideEffectsNone || calls != 0 {
+		t.Fatalf("validation rejection ran the handler or claimed effects: calls=%d %+v", calls, resp.Receipt)
+	}
+	if len(audit.logs) != 1 || audit.logs[0].State != agentcommand.StateRejected || audit.logs[0].OperationID != "" {
+		t.Fatalf("validation audit row: %+v", audit.logs)
+	}
+}
+
+// TestRepeatedConfirmExecutesOnce：确认卡重复确认不得二次执行（F10 分类改动
+// 不得放宽既有收口语义）；unknown 卡面也不得悬在待确认。
+func TestRepeatedConfirmExecutesOnce(t *testing.T) {
+	audit, cards := &memAudit{}, &memCards{}
+	bus := New(audit, cards, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	executed := 0
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{
+		ID: "demo.once", Title: "只执行一次", Danger: agentcommand.DangerHigh,
+	}, "/once", func(context.Context, Request) (any, error) {
+		executed++
+		return "done", nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if r := bus.Dispatch(context.Background(), Request{ID: "demo.once", Owner: "alice", ConversationID: "cnv_1"}); r.Receipt.State != agentcommand.StateAccepted {
+		t.Fatalf("pre-confirm: %+v", r.Receipt)
+	}
+	first := bus.Confirm("alice", "card_x1", "confirm")
+	second := bus.Confirm("alice", "card_x1", "confirm")
+	if first.Receipt.State != agentcommand.StateCommitted || executed != 1 {
+		t.Fatalf("confirm: %+v executed=%d", first.Receipt, executed)
+	}
+	if second.Receipt.State != agentcommand.StateRejected || second.Receipt.OperationID != "" || executed != 1 {
+		t.Fatalf("re-confirm executed twice: %+v executed=%d", second.Receipt, executed)
+	}
+}
+
+// TestLookupOperationIsOwnerProjectScoped（R7/KTD6）：unknown 回执的对账查询
+// 复用 owner/project 等值作用域；跨 owner、跨 project、缺作用域、未装配端口
+// 一律 fail-closed，查不到绝不推断"未执行"。
+func TestLookupOperationIsOwnerProjectScoped(t *testing.T) {
+	audit := &memAudit{}
+	query := &memOperationQuery{records: map[string]OperationRecord{}}
+	bus := New(audit, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	if _, err := bus.LookupOperation("alice", "proj_1", "op_1"); !errors.Is(err, ErrOperationQueryUnavailable) {
+		t.Fatalf("unwired query must fail closed: %v", err)
+	}
+	bus.SetOperationQuery(query)
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.write", Title: "写入"}, "", func(context.Context, Request) (any, error) {
+		// 副作用之后失败 → unknown + operationID（对账句柄）。
+		return nil, errors.New("ack lost")
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp := bus.Dispatch(context.Background(), Request{ID: "demo.write", Owner: "alice", Actor: "alice"})
+	if resp.Receipt.State != agentcommand.StateUnknown || resp.Receipt.OperationID == "" {
+		t.Fatalf("setup dispatch: %+v", resp.Receipt)
+	}
+	// 对账记录＝总线真实落下的审计信封（同一 owner/project 快照）。
+	for _, env := range audit.logs {
+		query.recordAudit("alice", "proj_1", env)
+	}
+	op := resp.Receipt.OperationID
+	record, err := bus.LookupOperation("alice", "proj_1", op)
+	if err != nil {
+		t.Fatalf("owner-scoped lookup: %v", err)
+	}
+	if record.OperationID != op || record.CommandID != "demo.write" || record.State != agentcommand.StateUnknown {
+		t.Fatalf("lookup returned the wrong record: %+v", record)
+	}
+	if _, err := bus.LookupOperation("bob", "proj_1", op); !errors.Is(err, ErrOperationNotRecorded) {
+		t.Fatalf("cross-owner lookup must not resolve: %v", err)
+	}
+	if _, err := bus.LookupOperation("alice", "proj_other", op); !errors.Is(err, ErrOperationNotRecorded) {
+		t.Fatalf("cross-project lookup must not resolve: %v", err)
+	}
+	for _, scope := range [][3]string{{"", "proj_1", op}, {"alice", "", op}, {"alice", "proj_1", ""}} {
+		if _, err := bus.LookupOperation(scope[0], scope[1], scope[2]); !errors.Is(err, ErrOperationScope) {
+			t.Fatalf("scope %v must fail closed: %v", scope, err)
+		}
+	}
+	if _, err := bus.LookupOperation("bob", "proj_1", "op_absent"); !errors.Is(err, ErrOperationNotRecorded) {
+		t.Fatalf("unknown operation must not be reported as executed: %v", err)
+	}
+}

internal/cmdbus/host_guard_test.go

@@ -0,0 +1,94 @@
+package cmdbus
+
+// 基座项目门禁在命令总线上的行为（临时会话隔离，U2）：SetHostProjectGuard 装
+// 的门禁对所有带 HostProjectID 的分发生效，且在 handler 与项目工作预检之前。
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+)
+
+// TestHostProjectGuardRefusesBeforeHandler 基座项目门禁：带宿主的请求先过门禁，
+// 拒绝时 handler 与预检都不该被调用；同一个命令换一个普通宿主项目照旧执行。
+func TestHostProjectGuardRefusesBeforeHandler(t *testing.T) {
+	audit := &memAudit{}
+	bus := New(audit, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	handled, preflights := 0, 0
+	bus.SetProjectWorkPreflight(func(context.Context, Request) error { preflights++; return nil })
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "rdm.reqs.add", Title: "登记需求"}, "",
+		func(context.Context, Request) (any, error) { handled++; return map[string]any{"ok": true}, nil }); err != nil {
+		t.Fatal(err)
+	}
+	bus.SetHostProjectGuard(func(_ context.Context, req Request) error {
+		if strings.HasPrefix(req.ID, "rdm.") || RequiresProjectWorkDecision(req.ID) {
+			if req.HostProjectID == "prj_scratch" {
+				return errors.New("not available in scratch sessions")
+			}
+		}
+		return nil
+	})
+
+	resp := bus.Dispatch(context.Background(), Request{
+		ID: "rdm.reqs.add", Entrance: "chat", Actor: "alice", Owner: "alice",
+		ConversationID: "cnv_scratch", HostProjectID: "prj_scratch",
+	})
+	if resp.Receipt.State != agentcommand.StateRejected {
+		t.Fatalf("scratch host dispatch state = %s, want rejected", resp.Receipt.State)
+	}
+	if !strings.HasPrefix(resp.Receipt.Reason, "host project: ") ||
+		!strings.Contains(resp.Receipt.Reason, "not available in scratch sessions") {
+		t.Fatalf("scratch host rejection reason = %q", resp.Receipt.Reason)
+	}
+	if handled != 0 || preflights != 0 {
+		t.Fatalf("guard ran late: handler=%d preflight=%d", handled, preflights)
+	}
+
+	// 正面：同一命令在普通项目宿主上不被这条门禁拒绝。
+	ok := bus.Dispatch(context.Background(), Request{
+		ID: "rdm.reqs.add", Entrance: "chat", Actor: "alice", Owner: "alice",
+		ConversationID: "cnv_normal", HostProjectID: "prj_normal",
+	})
+	if ok.Receipt.State != agentcommand.StateCommitted || handled != 1 || preflights != 1 {
+		t.Fatalf("normal host dispatch = %+v handler=%d preflight=%d", ok.Receipt, handled, preflights)
+	}
+}
+
+// TestHostProjectGuardSkipsHostlessAndUnrelatedCommands 门禁只作用于带宿主的
+// 请求与非项目命令；会话类命令在同一个临时会话宿主上照旧可用。
+func TestHostProjectGuardSkipsHostlessAndUnrelatedCommands(t *testing.T) {
+	bus := New(&memAudit{}, nil, func() time.Time { return time.Unix(1700000000, 0).UTC() })
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.ping", Title: "Ping"}, "",
+		func(context.Context, Request) (any, error) { return map[string]any{"pong": true}, nil }); err != nil {
+		t.Fatal(err)
+	}
+	guarded := 0
+	bus.SetHostProjectGuard(func(_ context.Context, req Request) error {
+		guarded++
+		if req.HostProjectID == "prj_scratch" && strings.HasPrefix(req.ID, "rdm.") {
+			return errors.New("not available in scratch sessions")
+		}
+		return nil
+	})
+
+	resp := bus.Dispatch(context.Background(), Request{
+		ID: "demo.ping", Entrance: "chat", Actor: "alice", Owner: "alice", HostProjectID: "prj_scratch",
+	})
+	if resp.Receipt.State != agentcommand.StateCommitted {
+		t.Fatalf("conversation command on a scratch host = %+v", resp.Receipt)
+	}
+	if guarded != 1 {
+		t.Fatalf("host guard calls = %d, want 1", guarded)
+	}
+	hostless := bus.Dispatch(context.Background(), Request{ID: "demo.ping", Entrance: "api", Actor: "alice", Owner: "alice"})
+	if hostless.Receipt.State != agentcommand.StateCommitted {
+		t.Fatalf("hostless dispatch = %+v", hostless.Receipt)
+	}
+	if guarded != 1 {
+		t.Fatalf("host guard ran for a hostless dispatch: %d", guarded)
+	}
+}

internal/cmdbus/pending_store_test.go

@@ -2,7 +2,9 @@ package cmdbus
 
 import (
 	"context"
+	"errors"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	agentcommand "agent-command"
@@ -31,3 +33,35 @@ func TestPendingConfirmRestoredAfterRestart(t *testing.T) {
 		t.Fatalf("restored confirm: %+v", again.Receipt)
 	}
 }
+
+// failingPendingStore 是"确认卡已创建、挂起态写不进去"的替身：受理已经发生
+// （卡在收件箱里），只是结果不可知。
+type failingPendingStore struct{ err error }
+
+func (p *failingPendingStore) SavePendingConfirm(string, string, string) error { return p.err }
+func (p *failingPendingStore) TakePendingConfirm(string) (string, string, bool, error) {
+	return "", "", false, p.err
+}
+
+// TestConfirmPendingWriteFailureKeepsCardOperationID：挂起态落盘失败不得吞掉操作
+// 标识——卡 ID 就是本次受理的句柄，unknown 必须带出去（否则受理事实无凭证）。
+func TestConfirmPendingWriteFailureKeepsCardOperationID(t *testing.T) {
+	audit, cards := &memAudit{}, &memCards{}
+	b := newTestBus(audit, cards)
+	b.SetPendingStore(&failingPendingStore{err: errors.New("pending store down")})
+	resp := b.Dispatch(context.Background(), Request{
+		ID: "demo.risky", Params: map[string]any{"target": "prod"}, ConversationID: "cnv_1", Owner: "alice",
+	})
+	if resp.Receipt.State != agentcommand.StateUnknown || !strings.Contains(resp.Receipt.Reason, "confirm pending") {
+		t.Fatalf("pending write failure: %+v", resp.Receipt)
+	}
+	if resp.Receipt.OperationID != "card_x1" || resp.Receipt.Validate() != nil {
+		t.Fatalf("pending write failure dropped the card operation handle: %+v", resp.Receipt)
+	}
+	if len(cards.created) != 1 || len(b.pending) != 0 {
+		t.Fatalf("card created=%d pending=%d", len(cards.created), len(b.pending))
+	}
+	if len(audit.logs) != 1 || audit.logs[0].State != agentcommand.StateUnknown || audit.logs[0].OperationID != "card_x1" {
+		t.Fatalf("audit envelope: %+v", audit.logs)
+	}
+}

internal/intentgate/gate.go

@@ -7,6 +7,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"sort"
+	"strings"
 	"sync"
 
 	agentintent "agent-intent/intent"
@@ -14,8 +16,21 @@ import (
 
 // SlotQuestion 是命中意图后仍缺的必填槽位，以及建议的提问。
 type SlotQuestion struct {
-	Key      string
-	Question string
+	Key      string `json:"key"`
+	Question string `json:"question"`
+}
+
+// SlotDefect 是一条槽位缺陷，来自权威识别结果的校验（F09）：
+//   - Invalid=true：捕获到了值但没通过确定性校验（枚举/格式/校验器/跨度重叠/
+//     生成路径的未知键），Reason 是库层原因原文；
+//   - Invalid=false：必填槽位根本没给（等价于 SlotQuestion，Reason 为空）。
+//
+// 宿主据此区分「没给」与「给错了」，两种情形都不派发业务动作。
+type SlotDefect struct {
+	Key      string `json:"key"`
+	Reason   string `json:"reason,omitempty"`
+	Question string `json:"question"`
+	Invalid  bool   `json:"invalid"`
 }
 
 // MatchResult 是一次识别。Branch 与 Match 相同。
@@ -24,25 +39,45 @@ type MatchResult struct {
 	ID      string
 	Slots   map[string]string
 	Missing []SlotQuestion
+	// Invalid 是捕获到但未通过权威校验的槽位（含生成路径的未知键）。
+	// 与 Missing 分开投影：必填且非法只进此处，不重复计入 Missing。
+	Invalid []SlotDefect
+	// Risk/RequiresConfirm/Action 是权威候选的声明（规则路径与生成路径同款）：
+	// 风险档、是否要求显式确认、spec.action 显式动作引用。nil Action 表示未声明。
+	Risk            string
+	RequiresConfirm bool
+	Action          *ActionRef
 	// Commands 是库层展开的命令列表（I1）；Router 消费它做唯一裁决。
 	// guard_hit/expectation_hit 被折叠为 fallback 时为空。
 	Commands []Command
 }
 
-// 命令类型经闸门投影（别名）：生态库按边界规则只许本包导入，
-// Router/runmgr 等消费方只依赖本包表面。
+// Complete 报告槽位是否齐全且全部通过权威校验：false 时业务动作不得派发。
+func (m MatchResult) Complete() bool { return len(m.Missing) == 0 && len(m.Invalid) == 0 }
+
+// 命令与目录类型经闸门投影（别名）：生态库按边界规则只许本包导入，
+// Router/runmgr 等消费方只依赖本包表面。CatalogSpec/CatalogSlot 随生成器端口
+// （SetGenerator 的入参）投影，实现生成器不必越过本包直接引用生态库。
 type (
-	Command   = agentintent.Command
-	ActionRef = agentintent.ActionRef
+	Command     = agentintent.Command
+	ActionRef   = agentintent.ActionRef
+	CatalogSpec = agentintent.CatalogSpec
+	CatalogSlot = agentintent.CatalogSlot
 )
 
 const (
-	CommandStart    = agentintent.CommandStart
-	ActionAuto      = agentintent.ActionAuto
-	ActionCommand   = agentintent.ActionCommand
-	ActionWorkflow  = agentintent.ActionWorkflow
-	ActionBlueprint = agentintent.ActionBlueprint
-	ActionHandler   = agentintent.ActionHandler
+	CommandStart      = agentintent.CommandStart
+	CommandSetSlot    = agentintent.CommandSetSlot
+	CommandChangeSlot = agentintent.CommandChangeSlot
+	CommandCancel     = agentintent.CommandCancel
+	CommandClarify    = agentintent.CommandClarify
+	CommandChitchat   = agentintent.CommandChitchat
+	CommandHandoff    = agentintent.CommandHandoff
+	ActionAuto        = agentintent.ActionAuto
+	ActionCommand     = agentintent.ActionCommand
+	ActionWorkflow    = agentintent.ActionWorkflow
+	ActionBlueprint   = agentintent.ActionBlueprint
+	ActionHandler     = agentintent.ActionHandler
 )
 
 type Gate struct {
@@ -133,7 +168,7 @@ func (g *Gate) Match(ctx context.Context, input string) (string, string) {
 	return res.Branch, res.ID
 }
 
-// Recognize 在 Match 的结果上带上槽位和缺失提问。
+// Recognize 在 Match 的结果上带上槽位、缺失提问、非法原因与风险/确认/动作声明。
 func (g *Gate) Recognize(ctx context.Context, input string) MatchResult {
 	g.mu.RLock()
 	reg, rec, byID := g.reg, g.rec, g.specsByID
@@ -163,16 +198,45 @@ func (g *Gate) Recognize(ctx context.Context, input string) MatchResult {
 			out.Slots[k] = v
 		}
 	}
+	// 风险/确认/动作声明：规则路径与生成路径（candidateFromGenerated）同款字段，
+	// 宿主据此决定是否必须走确认，不在本包内裁决。
+	out.Risk = res.Top.Risk
+	out.RequiresConfirm = res.Top.RequiresConfirm
+	if res.Top.Action != nil {
+		action := *res.Top.Action
+		out.Action = &action
+	}
 	spec := byID[out.ID]
 	for _, key := range res.Top.MissingRequiredSlots {
-		q := key
-		for _, sl := range spec.Slots {
-			if sl.Key == key && sl.Question != "" {
-				q = sl.Question
-			}
-		}
-		out.Missing = append(out.Missing, SlotQuestion{Key: key, Question: q})
+		out.Missing = append(out.Missing, SlotQuestion{Key: key, Question: questionOf(spec, key)})
 	}
+	// 非法槽位按键名排序（识别结果里的 map 无序，投影必须确定）。
+	for _, key := range sortedKeys(res.Top.InvalidSlots) {
+		out.Invalid = append(out.Invalid, SlotDefect{
+			Key: key, Reason: res.Top.InvalidSlots[key], Invalid: true,
+			Question: questionOf(spec, key),
+		})
+	}
+	return out
+}
+
+// questionOf 取 spec 为该槽位声明的建议提问；没有就回落键名本身。
+func questionOf(spec agentintent.IntentSpec, key string) string {
+	for _, sl := range spec.Slots {
+		if sl.Key == key && strings.TrimSpace(sl.Question) != "" {
+			return sl.Question
+		}
+	}
+	return key
+}
+
+// sortedKeys 按键名排序，保证同一识别结果的投影顺序确定。
+func sortedKeys(m map[string]string) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
 	return out
 }
 

internal/intentgate/gate_test.go

@@ -3,6 +3,7 @@ package intentgate
 import (
 	"context"
 	"encoding/json"
+	"strings"
 	"testing"
 
 	agentintent "agent-intent/intent"
@@ -176,3 +177,149 @@ func TestGateGeneratorProducesCommands(t *testing.T) {
 		t.Fatalf("关闭生成层：branch = %s", branch)
 	}
 }
+
+// ---- F09：非法槽位与风险/确认/动作声明的透传（规则路径与生成路径同款）----
+
+// modeSpec 声明一个带枚举校验的风险意图：mode 与 topic 都是必填。
+func modeSpec(t *testing.T) json.RawMessage {
+	t.Helper()
+	return raw(t, map[string]any{
+		"id": "demo.mode", "domain": "demo", "version": 1,
+		"matcher":          map[string]any{"includes_any": []string{"切换"}},
+		"risk":             "high",
+		"requires_confirm": true,
+		"action":           map[string]any{"kind": "command", "id": "demo.mode"},
+		"slots": []map[string]any{
+			{"key": "mode", "required": true, "pattern": `模式[:：]\s*(\S+)`, "enum": []string{"摘要", "全文"}, "question": "要哪种模式？"},
+			{"key": "topic", "required": true, "pattern": `主题[:：]\s*(\S+)`, "question": "主题是什么？"},
+		},
+	})
+}
+
+func TestRecognizeKeepsInvalidSlotDetail(t *testing.T) {
+	g := New()
+	if err := g.Rebuild(context.Background(), []json.RawMessage{modeSpec(t)}); err != nil {
+		t.Fatal(err)
+	}
+	bad := g.Recognize(context.Background(), "切换 主题：核能 模式：随手写")
+	if bad.Branch != "matched" || bad.ID != "demo.mode" {
+		t.Fatalf("识别分支：%+v", bad)
+	}
+	if bad.Complete() {
+		t.Fatalf("非法枚举值不得算作完整：%+v", bad)
+	}
+	if len(bad.Missing) != 0 {
+		// 必填且非法只进 Invalid，不重复进 Missing。
+		t.Fatalf("非法槽位不应重复计入缺失：%+v", bad.Missing)
+	}
+	if len(bad.Invalid) != 1 {
+		t.Fatalf("非法槽位详情：%+v", bad.Invalid)
+	}
+	d := bad.Invalid[0]
+	if d.Key != "mode" || !d.Invalid || d.Reason != "value not in enum" || d.Question != "要哪种模式？" {
+		t.Fatalf("非法原因/提问未透传：%+v", d)
+	}
+	if _, leaked := bad.Slots["mode"]; leaked {
+		t.Fatalf("非法值不得进入已校验槽位表：%+v", bad.Slots)
+	}
+	if bad.Slots["topic"] != "核能" {
+		t.Fatalf("合法槽位丢失：%+v", bad.Slots)
+	}
+	// 风险/确认/动作声明一并透传（宿主据此决定确认与派发）。
+	if bad.Risk != "high" || !bad.RequiresConfirm {
+		t.Fatalf("风险元数据未透传：%+v", bad)
+	}
+	if bad.Action == nil || bad.Action.Kind != ActionCommand || bad.Action.ID != "demo.mode" {
+		t.Fatalf("动作声明未透传：%+v", bad.Action)
+	}
+
+	ok := g.Recognize(context.Background(), "切换 主题：核能 模式：摘要")
+	if !ok.Complete() || ok.Slots["mode"] != "摘要" || len(ok.Invalid) != 0 {
+		t.Fatalf("合法槽位识别：%+v", ok)
+	}
+}
+
+// 生成路径同样经过权威槽位校验：非法值与未知键都要带原因回到宿主。
+func TestRecognizeGeneratedPathCarriesSlotDetail(t *testing.T) {
+	g := New()
+	if err := g.Rebuild(context.Background(), []json.RawMessage{modeSpec(t)}); err != nil {
+		t.Fatal(err)
+	}
+	g.SetGenerator(stubGenerator{cmds: []Command{{
+		Kind:   CommandStart,
+		Action: ActionRef{Kind: ActionCommand, ID: "demo.mode"},
+		Slots:  map[string]string{"mode": "随手写", "topic": "核能"},
+	}}})
+	res := g.Recognize(context.Background(), "跟昨天一样")
+	if res.Branch != "matched" || res.ID != "demo.mode" {
+		t.Fatalf("生成路径识别：%+v", res)
+	}
+	if len(res.Invalid) != 1 || res.Invalid[0].Key != "mode" || res.Invalid[0].Reason != "value not in enum" ||
+		res.Invalid[0].Question != "要哪种模式？" {
+		t.Fatalf("生成路径非法详情：%+v", res.Invalid)
+	}
+	if _, leaked := res.Slots["mode"]; leaked || res.Complete() {
+		t.Fatalf("生成路径非法值不得进入槽位表：%+v", res.Slots)
+	}
+	if res.Risk != "high" || !res.RequiresConfirm || res.Action == nil {
+		t.Fatalf("生成路径风险元数据：%+v", res)
+	}
+
+	// 未知键：库层判为 invalid（reason=unknown slot key），宿主据此拒绝派发。
+	g.SetGenerator(stubGenerator{cmds: []Command{{
+		Kind:   CommandStart,
+		Action: ActionRef{Kind: ActionCommand, ID: "demo.mode"},
+		Slots:  map[string]string{"mode": "摘要", "topic": "核能"},
+	}}})
+	clean := g.Recognize(context.Background(), "跟昨天一样")
+	if !clean.Complete() || clean.Slots["mode"] != "摘要" {
+		t.Fatalf("生成路径合法槽位：%+v", clean)
+	}
+}
+
+// 必填槽位缺失与非法是两条独立通道：缺失走 Missing，非法走 Invalid。
+func TestRecognizeDistinguishesMissingFromInvalid(t *testing.T) {
+	g := New()
+	if err := g.Rebuild(context.Background(), []json.RawMessage{modeSpec(t)}); err != nil {
+		t.Fatal(err)
+	}
+	res := g.Recognize(context.Background(), "切换 主题：核能")
+	if len(res.Missing) != 1 || res.Missing[0].Key != "mode" || res.Missing[0].Question != "要哪种模式？" {
+		t.Fatalf("缺失投影：%+v", res.Missing)
+	}
+	if len(res.Invalid) != 0 {
+		t.Fatalf("缺失不得混进非法：%+v", res.Invalid)
+	}
+	if res.Complete() {
+		t.Fatal("缺必填槽位不得算作完整")
+	}
+}
+
+// 格式校验失败与枚举失败同款透传（原因原文来自库层，不做改写）。
+func TestRecognizeKeepsFormatFailureReason(t *testing.T) {
+	g := New()
+	spec := raw(t, map[string]any{
+		"id": "demo.ticket", "domain": "demo", "version": 1,
+		"matcher": map[string]any{"includes_any": []string{"开工单"}},
+		"slots": []map[string]any{{
+			"key": "issue", "required": true, "pattern": `编号[:：]\s*(\S+)`,
+			"format": `[A-Z]{2}-\d+`, "question": "编号是什么？",
+		}},
+	})
+	if err := g.Rebuild(context.Background(), []json.RawMessage{spec}); err != nil {
+		t.Fatal(err)
+	}
+	bad := g.Recognize(context.Background(), "开工单 编号：随手写的")
+	if len(bad.Invalid) != 1 || bad.Invalid[0].Key != "issue" || bad.Invalid[0].Question != "编号是什么？" {
+		t.Fatalf("格式失败明细：%+v", bad.Invalid)
+	}
+	if !strings.HasPrefix(bad.Invalid[0].Reason, "format mismatch") {
+		t.Fatalf("格式失败原因：%+v", bad.Invalid[0])
+	}
+	if bad.Complete() || len(bad.Missing) != 0 {
+		t.Fatalf("格式失败不得算作完整或缺失：%+v", bad)
+	}
+	if ok := g.Recognize(context.Background(), "开工单 编号：AB-12"); !ok.Complete() || ok.Slots["issue"] != "AB-12" {
+		t.Fatalf("格式合法：%+v", ok)
+	}
+}

internal/intentsession/intentsession.go

@@ -0,0 +1,469 @@
+// Package intentsession 是宿主侧的「会话内意图会话」服务（A1/U-A1b）。
+//
+// 它把一条可执行动作的预期（动作引用 + 仍缺的槽位 + 已收集的槽位）留在
+// 会话里，等用户后续轮次把槽位补齐，而不是把同一次识别丢掉重来：
+//
+//	Pending      读当前挂起预期（无会话/已过期即没有，过期行读侧惰性删除）
+//	Suspend      识别出「动作可执行但槽位未就绪」后挂起预期
+//	ApplyAnswer  把一轮用户回答折叠进会话、推进 revision、重新判定齐全性
+//	ApplyCommand 消费库层命令：set_slot/change_slot 改槽位、cancel 清预期
+//	Binding      读会话当前绑定的运行上下文（A1/U-A1c：取消意图的靶子来源）
+//	RecordCancel 记一次已派发的取消：清预期，留一条短期「已取消某运行」记录
+//
+// 纪律：
+//   - 会话语义只携带槽位与预期，绝不携带授权：高危动作的确认仍由 cmdbus
+//     收口，会话补齐不会绕过任何确认门禁。
+//   - 键是 (owner, project, conversation)：两个用户、两个项目的会话在构造上
+//     互不可见。
+//   - revision 单调递增：陈旧回答（期间已被别的轮次推进或取消）一律拒绝
+//     （ErrStale），绝不允许旧槽位漏进新任务。
+//   - 库层 Stage-1 语义不变：本服务只消费库层产出的 set_slot/change_slot/
+//     cancel/expectation 命令，不改动识别分支语义。
+//   - 「已取消」记录不是待补齐的动作：它不再吸收槽位、不再被回答折叠，
+//     只供紧接着的追问（如「确认取消」）如实回话（CancelRecordTTL 到期即
+//     惰性删除）。
+package intentsession
+
+import (
+	"errors"
+	"strings"
+	"time"
+
+	"agent-system-backend/internal/intentgate"
+	"agent-system-backend/internal/store"
+)
+
+// DefaultTTL 是挂起预期的默认存活时间（30 分钟；每次更新续期）。
+const DefaultTTL = 30 * time.Minute
+
+// CancelRecordTTL 是「已取消」记录的留存时间：只够紧接着的追问读到，
+// 绝不跨会话长期驻留。
+const CancelRecordTTL = 5 * time.Minute
+
+// CancelActionKind 标记会话行的预期是「一次已派发的取消」记录，而不是待补齐
+// 的动作。宿主据此不再把本行当挂起动作折叠，只把它当如实回话的依据。
+const CancelActionKind = "cancel"
+
+// cancelledRunSlot 是取消记录里被取消运行号所在的槽位键（宿主不透明）。
+const cancelledRunSlot = "cancelled_run_id"
+
+// runSlotKeys 是识别结果里承载运行号的槽位键（按优先级；固定序，结果确定）。
+var runSlotKeys = []string{"run_id", "runId", "run"}
+
+// ErrStale 表示调用方持有的 revision 已过期（期间会话已被推进或取消）。
+// 调用方遇到它必须丢弃这次折叠，不得据此执行任何动作。
+var ErrStale = errors.New("intentsession: stale session revision")
+
+// SlotValidator 按动作声明的 schema 校验一个槽位值（宿主注入：命令总线侧的
+// DECLARED schema）。返回错误即不采纳该值——非法值永远进不了会话槽位表。
+// 动作不可解析（未注册/非命令）时宿主返回 nil 表示不校验。
+type SlotValidator func(actionID, slot, value string) error
+
+// Service 是意图会话服务。用 New 构造；零值不可用。
+type Service struct {
+	st       *store.Store
+	validate SlotValidator
+	clock    func() time.Time
+	ttlValue time.Duration
+}
+
+// New 构造意图会话服务（挂起期默认 DefaultTTL，即每次更新后 30 分钟）。
+func New(st *store.Store) *Service {
+	return &Service{st: st, clock: time.Now, ttlValue: DefaultTTL}
+}
+
+// SetSlotValidator 接线动作声明 schema 的槽位校验（启动期调用）。
+func (s *Service) SetSlotValidator(v SlotValidator) { s.validate = v }
+
+// SetTTL 覆盖挂起期（<=0 回落 DefaultTTL；仅启动期与测试期调用）。
+func (s *Service) SetTTL(d time.Duration) {
+	if d <= 0 {
+		d = DefaultTTL
+	}
+	s.ttlValue = d
+}
+
+func (s *Service) ttl() time.Duration {
+	if s.ttlValue <= 0 {
+		return DefaultTTL
+	}
+	return s.ttlValue
+}
+
+func (s *Service) now() time.Time {
+	if s.clock == nil {
+		return time.Now()
+	}
+	return s.clock()
+}
+
+// Key 是一个会话的标识。Owner 与 Conversation 必填：owner 缺失即 fail-closed，
+// 绝不会退化成跨用户共享的会话状态。
+type Key struct {
+	Owner        string
+	Project      string
+	Conversation string
+}
+
+func (k Key) valid() bool { return k.Owner != "" && k.Conversation != "" }
+
+// Expectation 是挂起的可执行动作预期。Action 是权威动作引用（命令/工作流/
+// 小队/auto），Missing 是仍缺的槽位及建议提问。
+type Expectation struct {
+	IntentID string
+	Action   intentgate.ActionRef
+	Missing  []intentgate.SlotQuestion
+	Question string
+}
+
+// Session 是一个会话当前的意图会话状态。
+type Session struct {
+	Key Key
+	// Expectation 为 nil 表示没有挂起动作（已取消或已补齐）。
+	Expectation *Expectation
+	// Cancelled 非 nil 表示这一行是一次已派发的取消记录（不是待补齐动作）。
+	Cancelled *CancelRecord
+	Slots     map[string]string
+	Revision  int
+	ExpiresAt time.Time
+}
+
+// CancelRecord 是一次已派发的取消的短期记录：被取消的运行与其来源动作。
+type CancelRecord struct {
+	RunID  string
+	Intent string
+	Action string
+}
+
+// Binding 是会话当前绑定的运行上下文——「取消」意图的靶子来源（A1/U-A1c）。
+//
+// 它只声明「这个会话当时对着哪个运行」，不是授权：派发与确认仍在宿主侧的
+// 既有取消路径上收口。
+type Binding struct {
+	RunID  string
+	Intent string
+	Action string
+	// Cancelled 为真时这条绑定来自一次已派发的取消（而不是待补齐动作）：
+	// 宿主不应把它再当成可取消的靶子。
+	Cancelled bool
+}
+
+// Answer 是一轮用户回答折叠后的结果（由宿主从识别结果与库层命令投影）。
+type Answer struct {
+	// Slots 是本轮补上的槽位；Invalid 是本轮给出但没通过权威校验的槽位
+	// （key→原因：值不采纳，仍按非法追问）。
+	Slots   map[string]string
+	Invalid map[string]string
+	// Cancel 为真时本轮是取消：不折叠任何槽位，只清空挂起预期。
+	Cancel bool
+}
+
+// Outcome 是一次折叠的结果。nil 结果（error==nil）表示本轮没有任何会话
+// 语义：宿主保持既有行为，不改响应。
+type Outcome struct {
+	// Session 是折叠后的会话（取消或补齐被消费时为 nil）。
+	Session *Session
+	// Complete 表示动作已齐全：宿主可按与一次完整识别完全相同的准入与
+	// 派发路径执行（确认语义仍由 cmdbus 收口）。
+	Complete bool
+	// Cancelled 表示用户取消了挂起的补充（不得派发任何业务动作）。
+	Cancelled bool
+	// Slots 是累计后的全部槽位（Complete 时用于派发）。
+	Slots map[string]string
+	// Remaining/Invalid 是仍缺的槽位与本轮未通过的槽位（Complete=false 时
+	// 用于如实重新澄清）。
+	Remaining []intentgate.SlotQuestion
+	Invalid   []intentgate.SlotDefect
+	Question  string
+}
+
+// Pending 返回仍然有效的挂起预期。没有行、没有预期或已过期都返回 nil；
+// 过期行在读侧惰性删除（过期会话绝不影响新的一轮）。
+func (s *Service) Pending(key Key) (*Session, error) {
+	return s.load(key)
+}
+
+// Suspend 挂起一个可执行动作的预期并累计已抽到的槽位（续期）。已抽到的
+// 槽位不再计入仍缺清单（挂起即如实反映还差什么）。
+func (s *Service) Suspend(key Key, expectation Expectation, slots map[string]string) (*Session, error) {
+	cur, err := s.load(key)
+	if err != nil {
+		return nil, err
+	}
+	if cur != nil {
+		slots = mergeSlots(cur.Slots, slots)
+	}
+	var missing []intentgate.SlotQuestion
+	for _, q := range expectation.Missing {
+		if _, ok := slots[q.Key]; !ok {
+			missing = append(missing, q)
+		}
+	}
+	stored, err := s.st.PutIntentSession(key.Owner, key.Project, key.Conversation,
+		storeExpectation(Expectation{IntentID: expectation.IntentID, Action: expectation.Action,
+			Missing: missing, Question: expectation.Question}), slots, s.ttl())
+	if err != nil {
+		return nil, err
+	}
+	return fromStore(key, stored), nil
+}
+
+// ApplyAnswer 把一轮用户回答折叠进挂起的会话：合并槽位、推进 revision、
+// 重新判定齐全性。revision 不匹配时返回 ErrStale（不改任何状态）。
+func (s *Service) ApplyAnswer(key Key, revision int, answer Answer) (*Outcome, error) {
+	if answer.Cancel {
+		return s.ApplyCommand(key, revision, string(intentgate.CommandCancel), "", "")
+	}
+	cur, err := s.current(key, revision)
+	if err != nil || cur == nil {
+		return nil, err
+	}
+	if cur.Expectation == nil || cur.Cancelled != nil {
+		return nil, nil
+	}
+	if len(answer.Slots) == 0 && len(answer.Invalid) == 0 {
+		return nil, nil // 本轮没有槽位信息：不消耗 revision
+	}
+	merged := mergeSlots(cur.Slots, s.accepted(cur, answer))
+	expectation := *cur.Expectation
+	remaining, invalid := s.recheck(&expectation, merged, answer)
+	out := &Outcome{Slots: merged, Remaining: remaining, Invalid: invalid, Question: expectation.Question}
+	if len(remaining) == 0 && len(invalid) == 0 {
+		// 补齐即消费：会话状态归零，宿主按既有准入与派发路径执行。
+		if err := s.st.ClearIntentSession(key.Owner, key.Project, key.Conversation); err != nil {
+			return nil, err
+		}
+		out.Complete = true
+		return out, nil
+	}
+	stored, err := s.st.PutIntentSession(key.Owner, key.Project, key.Conversation,
+		storeExpectation(Expectation{IntentID: expectation.IntentID, Action: expectation.Action,
+			Missing: remaining, Question: expectation.Question}), merged, s.ttl())
+	if err != nil {
+		return nil, err
+	}
+	out.Session = fromStore(key, stored)
+	return out, nil
+}
+
+// ApplyCommand 消费库层会话命令：
+//   - set_slot / change_slot 写槽位（动作声明可解析时按声明校验，非法值不采纳）；
+//   - cancel 清空挂起预期（保留已收集槽位，revision +1 让在途回答作废）；
+//   - 其它种类（start/clarify/chitchat/handoff…）一律忽略，如实返回 nil。
+func (s *Service) ApplyCommand(key Key, revision int, kind, name, value string) (*Outcome, error) {
+	switch kind {
+	case string(intentgate.CommandSetSlot), string(intentgate.CommandChangeSlot):
+		if strings.TrimSpace(name) == "" {
+			return nil, nil
+		}
+		return s.ApplyAnswer(key, revision, Answer{Slots: map[string]string{name: value}})
+	case string(intentgate.CommandCancel):
+		cur, err := s.current(key, revision)
+		if err != nil || cur == nil {
+			return nil, err
+		}
+		if cur.Expectation == nil || cur.Cancelled != nil {
+			// 没有挂起动作可放弃；已取消记录更不是「待补齐的补充」，
+			// 如实报告「本会话没有会话语义」，绝不假装又取消了一次。
+			return nil, nil
+		}
+		if _, err := s.st.ClearIntentSessionExpectation(key.Owner, key.Project, key.Conversation); err != nil {
+			if errors.Is(err, store.ErrNotFound) {
+				return nil, nil
+			}
+			return nil, err
+		}
+		return &Outcome{Cancelled: true, Slots: cur.Slots}, nil
+	default:
+		return nil, nil // 未知命令种类：忽略，绝不假装已消费
+	}
+}
+
+// Drop 清空整个会话状态（动作已派发或用户明确放弃时用；幂等）。
+func (s *Service) Drop(key Key) error {
+	if !key.valid() {
+		return nil
+	}
+	return s.st.ClearIntentSession(key.Owner, key.Project, key.Conversation)
+}
+
+// Binding 返回会话当前绑定的运行上下文：
+//   - 挂起预期里已经抽到的运行号（连同其意图与动作）；
+//   - 或上一次取消留下的短期记录（Cancelled=true）。
+//
+// 没有绑定（无会话/已过期/抽到的槽位里没有运行号）一律返回 nil：宿主据此
+// 澄清，绝不臆造一个靶子。读取失败向上传播，宿主一律 fail-closed。
+func (s *Service) Binding(key Key) (*Binding, error) {
+	cur, err := s.load(key)
+	if err != nil || cur == nil || cur.Expectation == nil {
+		return nil, err
+	}
+	if cur.Cancelled != nil {
+		return &Binding{RunID: cur.Cancelled.RunID, Intent: cur.Cancelled.Intent,
+			Action: cur.Cancelled.Action, Cancelled: true}, nil
+	}
+	runID := runIDOf(cur.Slots)
+	if runID == "" {
+		return nil, nil
+	}
+	return &Binding{RunID: runID, Intent: cur.Expectation.IntentID, Action: cur.Expectation.Action.ID}, nil
+}
+
+// RecordCancel 记录一次已派发的取消：清空挂起预期（连带作废在途回答，
+// revision +1），留下一条短期可读的「已取消某运行」记录，供紧接着的追问
+// （如「确认取消」）如实回话。没有运行号或键不完整即不记录（fail-closed）。
+func (s *Service) RecordCancel(key Key, b Binding) (*Session, error) {
+	if !key.valid() || strings.TrimSpace(b.RunID) == "" {
+		return nil, nil
+	}
+	slots := map[string]string{cancelledRunSlot: strings.TrimSpace(b.RunID)}
+	stored, err := s.st.PutIntentSession(key.Owner, key.Project, key.Conversation,
+		storeExpectation(Expectation{IntentID: b.Intent,
+			Action: intentgate.ActionRef{Kind: CancelActionKind, ID: b.Action}}),
+		slots, CancelRecordTTL)
+	if err != nil {
+		return nil, err
+	}
+	return fromStore(key, stored), nil
+}
+
+// current 读出会话并校验 revision：过期行惰性删除返回 nil；revision 不匹配
+// 返回 ErrStale。
+func (s *Service) current(key Key, revision int) (*Session, error) {
+	cur, err := s.load(key)
+	if err != nil || cur == nil {
+		return nil, err
+	}
+	if revision > 0 && revision != cur.Revision {
+		return nil, ErrStale
+	}
+	return cur, nil
+}
+
+// load 读出会话；过期行惰性删除后返回 nil。
+func (s *Service) load(key Key) (*Session, error) {
+	if !key.valid() {
+		return nil, nil
+	}
+	cur, err := s.st.GetIntentSession(key.Owner, key.Project, key.Conversation)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if !s.live(cur) {
+		if err := s.st.ClearIntentSession(key.Owner, key.Project, key.Conversation); err != nil {
+			return nil, err
+		}
+		return nil, nil
+	}
+	return fromStore(key, cur), nil
+}
+
+// live 报告会话是否仍在有效期内。没有挂起预期的行（已取消/已补齐）对宿主
+// 等于「没有会话」。
+func (s *Service) live(cur store.IntentSession) bool {
+	if cur.Expectation == nil {
+		return false
+	}
+	if cur.ExpiresAt.IsZero() {
+		return true
+	}
+	return s.now().Before(cur.ExpiresAt)
+}
+
+// recheck 折叠后重算仍缺的槽位与本轮未通过校验的槽位（确定性顺序：沿用挂起
+// 时的缺失序；未通过的槽位保留其原提问并带上权威原因）。
+func (s *Service) recheck(expectation *Expectation, slots map[string]string, answer Answer) ([]intentgate.SlotQuestion, []intentgate.SlotDefect) {
+	var remaining []intentgate.SlotQuestion
+	var invalid []intentgate.SlotDefect
+	for _, q := range expectation.Missing {
+		if reason, bad := answer.Invalid[q.Key]; bad {
+			invalid = append(invalid, intentgate.SlotDefect{Key: q.Key, Reason: reason, Question: q.Question, Invalid: true})
+			continue
+		}
+		if _, ok := slots[q.Key]; !ok {
+			remaining = append(remaining, q)
+		}
+	}
+	return remaining, invalid
+}
+
+// accepted 采纳本轮通过校验的槽位：非法值不采纳（仍按非法追问），其余按
+// 动作声明校验（宿主注入；未接线即不校验）。
+func (s *Service) accepted(cur *Session, answer Answer) map[string]string {
+	out := map[string]string{}
+	for k, v := range answer.Slots {
+		if _, bad := answer.Invalid[k]; bad {
+			continue
+		}
+		if s.validate != nil && cur.Expectation != nil && cur.Expectation.Action.ID != "" {
+			if err := s.validate(cur.Expectation.Action.ID, k, v); err != nil {
+				continue
+			}
+		}
+		out[k] = v
+	}
+	return out
+}
+
+// missingOf 投影到存储形态（缺失槽位表）。
+func missingOf(list []intentgate.SlotQuestion) []store.IntentSlotQuestion {
+	out := make([]store.IntentSlotQuestion, 0, len(list))
+	for _, q := range list {
+		out = append(out, store.IntentSlotQuestion{Key: q.Key, Question: q.Question})
+	}
+	return out
+}
+
+// storeExpectation 投影到存储形态。
+func storeExpectation(e Expectation) *store.IntentExpectation {
+	return &store.IntentExpectation{
+		IntentID: e.IntentID, ActionKind: e.Action.Kind, ActionID: e.Action.ID,
+		Missing: missingOf(e.Missing), Question: e.Question,
+	}
+}
+
+// fromStore 从存储行投影出宿主视图。
+func fromStore(key Key, cur store.IntentSession) *Session {
+	out := &Session{Key: key, Slots: cur.Slots, Revision: cur.Revision, ExpiresAt: cur.ExpiresAt}
+	if cur.Expectation != nil {
+		exp := &Expectation{IntentID: cur.Expectation.IntentID, Question: cur.Expectation.Question,
+			Action: intentgate.ActionRef{Kind: cur.Expectation.ActionKind, ID: cur.Expectation.ActionID}}
+		for _, q := range cur.Expectation.Missing {
+			exp.Missing = append(exp.Missing, intentgate.SlotQuestion{Key: q.Key, Question: q.Question})
+		}
+		out.Expectation = exp
+		if exp.Action.Kind == CancelActionKind {
+			out.Cancelled = &CancelRecord{RunID: strings.TrimSpace(cur.Slots[cancelledRunSlot]),
+				Intent: exp.IntentID, Action: exp.Action.ID}
+		}
+	}
+	if out.Slots == nil {
+		out.Slots = map[string]string{}
+	}
+	return out
+}
+
+// runIDOf 从槽位表里取运行号（固定键序，结果与 map 迭代序无关；无则空）。
+func runIDOf(slots map[string]string) string {
+	for _, key := range runSlotKeys {
+		if v := strings.TrimSpace(slots[key]); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// mergeSlots 合并两组槽位（后者覆盖前者，返回新表：不改调用方的 map）。
+func mergeSlots(base, add map[string]string) map[string]string {
+	out := map[string]string{}
+	for k, v := range base {
+		out[k] = v
+	}
+	for k, v := range add {
+		out[k] = v
+	}
+	return out
+}

internal/intentsession/intentsession_test.go

@@ -0,0 +1,506 @@
+package intentsession
+
+import (
+	"errors"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"agent-system-backend/internal/intentgate"
+	"agent-system-backend/internal/store"
+)
+
+// A1/U-A1b：会话内意图会话。合成数据 + 嵌入式存储（PG 档由 store 包双档
+// 测试覆盖同一张表）。命令动作（run-cancel 形态）先行，取消路由归 U-A1c。
+
+func newService(t *testing.T) *Service {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "intent-session.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return New(st)
+}
+
+func cancelKey() Key { return Key{Owner: "alice", Project: "prj_1", Conversation: "cnv_1"} }
+
+// cancelExpectation 是首个动作（取消运行）：动作引用 + 仍缺槽位 + 提问。
+func cancelExpectation() Expectation {
+	return Expectation{
+		IntentID: "demo.run-cancel",
+		Action:   intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.run-cancel"},
+		Missing: []intentgate.SlotQuestion{
+			{Key: "run_id", Question: "取消哪个运行？"},
+			{Key: "reason", Question: "取消原因？"},
+		},
+		Question: "取消哪个运行？",
+	}
+}
+
+func questionKeys(list []intentgate.SlotQuestion) []string {
+	out := make([]string, 0, len(list))
+	for _, q := range list {
+		out = append(out, q.Key)
+	}
+	return out
+}
+
+// 无会话时 Pending 就是「没有」，且不产生任何行。
+func TestPendingWithoutSession(t *testing.T) {
+	svc := newService(t)
+	got, err := svc.Pending(cancelKey())
+	if err != nil || got != nil {
+		t.Fatalf("无会话时应为空：%v %v", got, err)
+	}
+	// 归属不完整即 fail-closed（不会退化成跨用户共享状态）。
+	if got, err := svc.Pending(Key{Conversation: "cnv_1"}); err != nil || got != nil {
+		t.Fatalf("无 owner 的键必须被拒：%v %v", got, err)
+	}
+}
+
+// 缺槽位动作 → 挂起 → 回答补齐：齐全即消费会话（宿主按既有准入派发）。
+func TestSuspendThenAnswerCompletes(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, cancelExpectation(), map[string]string{"run_id": "R-1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if suspended.Revision != 1 || suspended.Expectation == nil || suspended.Expectation.Action.ID != "demo.run-cancel" {
+		t.Fatalf("挂起结果：%+v", suspended)
+	}
+	if keys := questionKeys(suspended.Expectation.Missing); len(keys) != 1 || keys[0] != "reason" {
+		t.Fatalf("已抽到的槽位不应再算缺失：%v", keys)
+	}
+	if !suspended.ExpiresAt.After(time.Now()) {
+		t.Fatalf("到期时间未设：%v", suspended.ExpiresAt)
+	}
+
+	// 部分回答：仍缺原因 → 仍挂起、revision 递增、到期时间续期。
+	partial, err := svc.ApplyAnswer(key, suspended.Revision, Answer{Slots: map[string]string{"run_id": "R-2"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if partial.Complete || partial.Cancelled {
+		t.Fatalf("部分回答不得视为完成：%+v", partial)
+	}
+	if keys := questionKeys(partial.Remaining); len(keys) != 1 || keys[0] != "reason" {
+		t.Fatalf("剩余缺失：%v", keys)
+	}
+	if partial.Session.Revision != 2 || !partial.Session.ExpiresAt.After(suspended.ExpiresAt) {
+		t.Fatalf("revision/续期：%+v", partial.Session)
+	}
+
+	// 补齐最后一个：Complete=true，会话被消费。
+	done, err := svc.ApplyAnswer(key, partial.Session.Revision, Answer{Slots: map[string]string{"reason": "误触发"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !done.Complete || done.Session != nil {
+		t.Fatalf("补齐应完成并消费会话：%+v", done)
+	}
+	if done.Slots["run_id"] != "R-2" || done.Slots["reason"] != "误触发" {
+		t.Fatalf("累计槽位：%v", done.Slots)
+	}
+	if got, err := svc.Pending(key); err != nil || got != nil {
+		t.Fatalf("完成后仍挂起：%v %v", got, err)
+	}
+}
+
+// 两轮部分填充：set_slot 落一个槽位，再由回答补另一个。
+func TestSetSlotThenAnswerCompletes(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, cancelExpectation(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	set, err := svc.ApplyCommand(key, suspended.Revision, string(intentgate.CommandSetSlot), "run_id", "R-7")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if set.Complete || set.Session.Slots["run_id"] != "R-7" || set.Session.Revision != 2 {
+		t.Fatalf("set_slot 后：%+v", set)
+	}
+	if keys := questionKeys(set.Remaining); len(keys) != 1 || keys[0] != "reason" {
+		t.Fatalf("剩余缺失：%v", keys)
+	}
+	change, err := svc.ApplyCommand(key, set.Session.Revision, string(intentgate.CommandChangeSlot), "run_id", "R-8")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if change.Session.Slots["run_id"] != "R-8" {
+		t.Fatalf("change_slot 未改写：%+v", change.Session)
+	}
+	done, err := svc.ApplyAnswer(key, change.Session.Revision, Answer{Slots: map[string]string{"reason": "重复提交"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !done.Complete || done.Slots["run_id"] != "R-8" || done.Slots["reason"] != "重复提交" {
+		t.Fatalf("两轮补齐：%+v", done)
+	}
+}
+
+// 取消清空挂起预期：确认取消、不假装成功，陈旧回答也作废。
+func TestCancelClearsPendingExpectation(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, cancelExpectation(), map[string]string{"run_id": "R-1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := svc.ApplyCommand(key, suspended.Revision, string(intentgate.CommandCancel), "", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !out.Cancelled || out.Complete || out.Session != nil {
+		t.Fatalf("取消结果：%+v", out)
+	}
+	if got, err := svc.Pending(key); err != nil || got != nil {
+		t.Fatalf("取消后仍有挂起预期：%v %v", got, err)
+	}
+	if _, err := svc.ApplyAnswer(key, suspended.Revision, Answer{Slots: map[string]string{"reason": "误触发"}}); err != nil {
+		t.Fatalf("取消后不应再有会话可折叠：%v", err)
+	}
+}
+
+// 陈旧回答一律拒绝：期间 revision 已被别的轮次推进过。
+func TestStaleRevisionRejected(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, cancelExpectation(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	moved, err := svc.ApplyCommand(key, suspended.Revision, string(intentgate.CommandSetSlot), "run_id", "R-7")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := svc.ApplyAnswer(key, suspended.Revision, Answer{Slots: map[string]string{"reason": "旧回答"}}); !errors.Is(err, ErrStale) {
+		t.Fatalf("陈旧回答必须被拒：%v", err)
+	}
+	if _, err := svc.ApplyCommand(key, suspended.Revision, string(intentgate.CommandCancel), "", ""); !errors.Is(err, ErrStale) {
+		t.Fatalf("陈旧取消必须被拒：%v", err)
+	}
+	// 状态未被陈旧回答改动：仍是推进后的那一版。
+	cur, err := svc.Pending(key)
+	if err != nil || cur.Revision != moved.Session.Revision || cur.Slots["run_id"] != "R-7" || cur.Slots["reason"] != "" {
+		t.Fatalf("陈旧回答改动了状态：%+v %v", cur, err)
+	}
+}
+
+// 过期会话既不补齐旧动作，也不影响新的挂起：读侧惰性删除过期行。
+func TestExpiredSessionNeverCompletesOldAction(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, cancelExpectation(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// 时钟前移越过到期时间：过期会话对任何新轮次都不存在。
+	svc.clock = func() time.Time { return suspended.ExpiresAt.Add(time.Second) }
+
+	got, err := svc.Pending(key)
+	if err != nil || got != nil {
+		t.Fatalf("过期会话仍可见：%v %v", got, err)
+	}
+	if out, err := svc.ApplyAnswer(key, suspended.Revision, Answer{Slots: map[string]string{"run_id": "R-1", "reason": "误触发"}}); err != nil || out != nil {
+		t.Fatalf("过期回答不得补齐旧动作：%+v %v", out, err)
+	}
+	// 过期行已删除 → 新任务重新挂起时从干净状态开始。
+	fresh, err := svc.Suspend(key, Expectation{IntentID: "demo.purge",
+		Action:   intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.purge"},
+		Missing:  []intentgate.SlotQuestion{{Key: "target", Question: "清理哪个对象？"}},
+		Question: "清理哪个对象？"}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fresh.Revision != 1 || fresh.Slots["run_id"] != "" {
+		t.Fatalf("新挂起被旧会话污染：%+v", fresh)
+	}
+}
+
+// 两个用户、两个项目在构造上互不可见。
+func TestSessionsAreIsolatedByOwnerAndProject(t *testing.T) {
+	svc := newService(t)
+	alice := Key{Owner: "alice", Project: "prj_1", Conversation: "cnv_1"}
+	bob := Key{Owner: "bob", Project: "prj_1", Conversation: "cnv_1"}
+	other := Key{Owner: "alice", Project: "prj_2", Conversation: "cnv_1"}
+	otherConv := Key{Owner: "alice", Project: "prj_1", Conversation: "cnv_2"}
+
+	suspended, err := svc.Suspend(alice, cancelExpectation(), map[string]string{"run_id": "R-alice"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range []Key{bob, other, otherConv} {
+		got, err := svc.Pending(key)
+		if err != nil || got != nil {
+			t.Fatalf("%+v 读到了别人的会话：%v %v", key, got, err)
+		}
+		// 陈旧的答案也绝不命中别人的会话。
+		out, err := svc.ApplyAnswer(key, suspended.Revision, Answer{Slots: map[string]string{"run_id": "R-x", "reason": "x"}})
+		if err != nil || out != nil {
+			t.Fatalf("%+v 的回答折叠进了别人的会话：%+v %v", key, out, err)
+		}
+		if err := svc.Drop(key); err != nil {
+			t.Fatal(err)
+		}
+	}
+	cur, err := svc.Pending(alice)
+	if err != nil || cur == nil || cur.Slots["run_id"] != "R-alice" || cur.Revision != 1 {
+		t.Fatalf("属主会话被影响：%+v %v", cur, err)
+	}
+}
+
+// 槽位值按动作声明 schema 校验：非法值不采纳（仍按缺失追问），
+// 合法值正常折叠。
+func TestAnswerSlotsValidatedAgainstDeclaredSchema(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	var validated []string
+	svc.SetSlotValidator(func(actionID, slot, value string) error {
+		if actionID != "demo.run-cancel" || slot != "count" {
+			return nil
+		}
+		validated = append(validated, value)
+		if value == "abc" {
+			return errors.New("不是整数")
+		}
+		return nil
+	})
+	expectation := Expectation{IntentID: "demo.run-cancel",
+		Action:   intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.run-cancel"},
+		Missing:  []intentgate.SlotQuestion{{Key: "count", Question: "几次？"}, {Key: "reason", Question: "原因？"}},
+		Question: "几次？"}
+	suspended, err := svc.Suspend(key, expectation, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bad, err := svc.ApplyAnswer(key, suspended.Revision, Answer{Slots: map[string]string{"count": "abc"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bad.Complete || bad.Session.Slots["count"] != "" {
+		t.Fatalf("非法值被采纳：%+v", bad.Session)
+	}
+	if keys := questionKeys(bad.Remaining); len(keys) != 2 {
+		t.Fatalf("非法值应仍按缺失追问：%v", keys)
+	}
+	if len(validated) != 1 || validated[0] != "abc" {
+		t.Fatalf("声明校验未生效：%v", validated)
+	}
+	good, err := svc.ApplyAnswer(key, bad.Session.Revision, Answer{Slots: map[string]string{"count": "3", "reason": "误触发"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !good.Complete || good.Slots["count"] != "3" {
+		t.Fatalf("合法值未补齐：%+v", good)
+	}
+}
+
+// 本轮给出但没通过权威校验的值：如实按非法追问（值不采纳）。
+func TestInvalidAnswerIsReportedNotAdopted(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, Expectation{IntentID: "demo.run-cancel",
+		Action:   intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.run-cancel"},
+		Missing:  []intentgate.SlotQuestion{{Key: "mode", Question: "要哪种模式？"}},
+		Question: "要哪种模式？"}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := svc.ApplyAnswer(key, suspended.Revision, Answer{
+		Slots:   map[string]string{"mode": "随手写"},
+		Invalid: map[string]string{"mode": "value not in enum"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out.Complete || out.Session.Slots["mode"] != "" {
+		t.Fatalf("非法值被采纳：%+v", out)
+	}
+	if len(out.Invalid) != 1 || out.Invalid[0].Key != "mode" || out.Invalid[0].Reason != "value not in enum" {
+		t.Fatalf("非法原因未透传：%+v", out.Invalid)
+	}
+	if len(out.Remaining) != 0 {
+		t.Fatalf("非法不应重复计入缺失：%+v", out.Remaining)
+	}
+}
+
+// 未知命令种类如实忽略：不改状态、不假装已消费。
+func TestUnknownCommandsAreIgnored(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, cancelExpectation(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, kind := range []string{string(intentgate.CommandStart), string(intentgate.CommandClarify),
+		string(intentgate.CommandChitchat), string(intentgate.CommandHandoff), "made-up"} {
+		out, err := svc.ApplyCommand(key, suspended.Revision, kind, "run_id", "R-9")
+		if err != nil || out != nil {
+			t.Fatalf("%s 不得被当成会话命令：%+v %v", kind, out, err)
+		}
+	}
+	cur, err := svc.Pending(key)
+	if err != nil || cur.Revision != suspended.Revision || cur.Slots["run_id"] != "" {
+		t.Fatalf("未知命令改动了状态：%+v %v", cur, err)
+	}
+	// 没有槽位名时同样忽略（不写入空键）。
+	if out, err := svc.ApplyCommand(key, suspended.Revision, string(intentgate.CommandSetSlot), "  ", "R-9"); err != nil || out != nil {
+		t.Fatalf("空槽位名必须被忽略：%+v %v", out, err)
+	}
+}
+
+// Drop 幂等清空；之后重新挂起从 revision 1 开始。
+func TestDropIsIdempotent(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	if _, err := svc.Suspend(key, cancelExpectation(), nil); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 2; i++ {
+		if err := svc.Drop(key); err != nil {
+			t.Fatalf("drop %d：%v", i, err)
+		}
+	}
+	if err := svc.Drop(Key{Conversation: "cnv_1"}); err != nil {
+		t.Fatalf("不完整的键必须安全无操作：%v", err)
+	}
+	again, err := svc.Suspend(key, cancelExpectation(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again.Revision != 1 || again.Slots["run_id"] != "" {
+		t.Fatalf("drop 后重新挂起：%+v", again)
+	}
+}
+
+// ---- A1/U-A1c：取消的靶子来源（Binding）与已取消记录（RecordCancel）----
+
+// 挂起预期里已经抽到的运行号就是取消的靶子；连同意图与动作一并透出。
+func TestBindingComesFromSuspendedSlots(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	// 没有会话 → 没有靶子（绝不臆造）。
+	if got, err := svc.Binding(key); err != nil || got != nil {
+		t.Fatalf("无会话时必须有 binding：%v %v", got, err)
+	}
+	// 槽位里没有运行号 → 同样没有靶子。
+	if _, err := svc.Suspend(key, cancelExpectation(), nil); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := svc.Binding(key); err != nil || got != nil {
+		t.Fatalf("无运行号时必须没有靶子：%v %v", got, err)
+	}
+	// 抽到运行号 → 靶子就绪（取消意图据此可无澄清地派发）。
+	svc.Drop(key)
+	if _, err := svc.Suspend(key, cancelExpectation(), map[string]string{"run_id": "R-7"}); err != nil {
+		t.Fatal(err)
+	}
+	got, err := svc.Binding(key)
+	if err != nil || got == nil {
+		t.Fatalf("有运行号时必须解出靶子：%v %v", got, err)
+	}
+	if got.RunID != "R-7" || got.Intent != "demo.run-cancel" || got.Action != "demo.run-cancel" || got.Cancelled {
+		t.Fatalf("靶子上下文：%+v", got)
+	}
+	// runId/run 两种写法同样识别（键序固定，结果确定）。
+	svc.Drop(key)
+	for _, slot := range []string{"runId", "run"} {
+		if _, err := svc.Suspend(key, cancelExpectation(), map[string]string{slot: "R-8", "reason": "误触发"}); err != nil {
+			t.Fatal(err)
+		}
+		if got, _ := svc.Binding(key); got == nil || got.RunID != "R-8" {
+			t.Fatalf("槽位 %s 未被识别为运行号：%+v", slot, got)
+		}
+		svc.Drop(key)
+	}
+}
+
+// 已派发的取消：清挂起预期 + 留短期记录；记录不可再被回答折叠，也不作靶子。
+func TestRecordCancelClearsExpectationAndKeepsShortLivedRecord(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	suspended, err := svc.Suspend(key, cancelExpectation(), map[string]string{"run_id": "R-7"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorded, err := svc.RecordCancel(key, Binding{RunID: "R-7", Intent: "demo.task-cancel", Action: "demo.run-cancel"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if recorded == nil || recorded.Cancelled == nil || recorded.Cancelled.RunID != "R-7" {
+		t.Fatalf("取消记录：%+v", recorded)
+	}
+	if recorded.Cancelled.Intent != "demo.task-cancel" || recorded.Cancelled.Action != "demo.run-cancel" {
+		t.Fatalf("取消记录上下文：%+v", recorded.Cancelled)
+	}
+	if recorded.Revision <= suspended.Revision {
+		t.Fatalf("取消必须推进 revision（让在途回答作废）：%d vs %d", recorded.Revision, suspended.Revision)
+	}
+	if len(recorded.Expectation.Missing) != 0 || recorded.Slots["run_id"] != "" {
+		t.Fatalf("取消后不得还留着待补齐的槽位/缺失：%+v", recorded)
+	}
+	// 记录仍可读：宿主据此如实回答「确认取消」这类追问。
+	got, err := svc.Binding(key)
+	if err != nil || got == nil || got.RunID != "R-7" || !got.Cancelled {
+		t.Fatalf("取消记录应可读且标记为已取消：%+v %v", got, err)
+	}
+	// 取消记录不是待补齐的动作：回答与 cancel 命令都不再折叠进它。
+	if out, err := svc.ApplyAnswer(key, recorded.Revision, Answer{Slots: map[string]string{"reason": "误触发"}}); err != nil || out != nil {
+		t.Fatalf("取消记录不得吸收回答：%+v %v", out, err)
+	}
+	if out, err := svc.ApplyCommand(key, recorded.Revision, string(intentgate.CommandCancel), "", ""); err != nil || out != nil {
+		t.Fatalf("取消记录不得再被取消一次：%+v %v", out, err)
+	}
+	if cur, err := svc.Pending(key); err != nil || cur == nil || cur.Cancelled == nil {
+		t.Fatalf("取消记录不得被当成挂起动作改写：%+v %v", cur, err)
+	}
+	// 记录短期留存：越过 CancelRecordTTL 后对任何新轮次都不存在。
+	svc.clock = func() time.Time { return recorded.ExpiresAt.Add(time.Second) }
+	if got, err := svc.Binding(key); err != nil || got != nil {
+		t.Fatalf("过期记录仍可见：%+v %v", got, err)
+	}
+	if _, err := svc.Pending(key); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := svc.st.GetIntentSession(key.Owner, key.Project, key.Conversation); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("过期行未被惰性删除：%v", err)
+	}
+}
+
+// 缺键或没有运行号时如实不记录（fail-closed，绝不写半条取消记录）。
+func TestRecordCancelIsFailClosed(t *testing.T) {
+	svc := newService(t)
+	key := cancelKey()
+	if got, err := svc.RecordCancel(Key{Conversation: "cnv_1"}, Binding{RunID: "R-7"}); err != nil || got != nil {
+		t.Fatalf("缺 owner 的键必须无操作：%+v %v", got, err)
+	}
+	if got, err := svc.RecordCancel(key, Binding{RunID: "  "}); err != nil || got != nil {
+		t.Fatalf("没有运行号必须无操作：%+v %v", got, err)
+	}
+	if got, err := svc.Binding(key); err != nil || got != nil {
+		t.Fatalf("无操作不得留下任何行：%+v %v", got, err)
+	}
+}
+
+// 两个用户的绑定互不可见：别人的运行号绝不会成为本会话的靶子。
+func TestBindingIsIsolatedByOwner(t *testing.T) {
+	svc := newService(t)
+	alice := Key{Owner: "alice", Project: "prj_1", Conversation: "cnv_1"}
+	bob := Key{Owner: "bob", Project: "prj_1", Conversation: "cnv_1"}
+	if _, err := svc.Suspend(alice, cancelExpectation(), map[string]string{"run_id": "R-alice"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := svc.RecordCancel(bob, Binding{RunID: "R-bob"}); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := svc.Binding(bob); got == nil || got.RunID != "R-bob" {
+		t.Fatalf("bob 的绑定：%+v", got)
+	}
+	if got, _ := svc.Binding(alice); got == nil || got.RunID != "R-alice" || got.Cancelled {
+		t.Fatalf("alice 的绑定被污染：%+v", got)
+	}
+}

internal/route/route.go

@@ -10,15 +10,31 @@
 //   - PromptTrigger（技能触发）是提示词装配、不参与路由决胜；
 //     意图产出 Start/Clarify 类命令时路由优先。
 //
+// 槽位准入（F09）：可执行业务动作（命令总线）必须在槽位齐全且全部通过
+// 权威校验时才派发；缺失或非法一律不派发，转澄清诉求（Clarification）。
+// 工作流是「边收集边执行」的草稿：按既有规则照常启动，缺失清单随决策透出，
+// 由流程自身追问——非法值不会进入槽位表（库层只把合法值写进 Slots）。
+//
 // 当前版本的已知边界（如实记录，不静默）：
 //   - squad 决策需要 runmgr 的 per-run entry 覆盖才能真正执行（独立设计项）；
 //     本版本调用方按普通回合处理并保留 Decision 供审计。
-//   - SetSlot/Cancel/Handoff 命令由库层产出，但 Backend 尚无会话槽位状态机
-//     与语义层，Router v1 不消费它们（expectation_hit 在 intentgate 已被折叠为
-//     fallback，Start 只来自 matched）。
+//   - Handoff 仍由宿主不消费，记 Unsupported 并回落普通回合。
+//   - Cancel 已是宿主可执行的既有动作（A1/U-A1c）：本包只解出「取消哪一个
+//     运行」——原文点名的运行号优先，其次当前会话绑定动作的运行上下文
+//     （Env.SessionRun，宿主从意图会话注入）。解不出唯一靶子时 Decision
+//     如实留空 RunID 并写明原因，由宿主澄清，绝不替用户猜一个。
+//     本包不派发取消、也不认识取消的实现（收件箱/命令总线的确认语义都在
+//     宿主侧），更不自动确认。
+//   - SetSlot/ChangeSlot 已被宿主消费，但消费的语义不在本包：宿主 chat 入口
+//     把它们折叠进会话里的挂起预期（internal/intentsession 的会话状态机，
+//     A1/U-A1b）——落槽与改槽是「同一动作的补充说明」，不是可派发的动作。
+//     本包仍不把它们当动作派发：命中即记 Unsupported 并回落普通回合，
+//     同时绝不把同一句话里的 Start 当作业务动作派发。
 package route
 
 import (
+	"strings"
+
 	"agent-system-backend/internal/intentgate"
 	core "agent-system-core"
 )
@@ -31,8 +47,56 @@ const (
 	KindWorkflow Kind = "workflow"
 	KindSquad    Kind = "squad"
 	KindTurn     Kind = "turn"
+	// KindCancel 是「取消」意图的裁决：取消是既有动作（取消一个运行），
+	// 不是可以顺带启动的动作。靶子解出与否都在 Decision.Cancel 里，
+	// 派发与确认由宿主按既有取消路径完成。
+	KindCancel Kind = "cancel"
 )
 
+// CancelSource 说明取消靶子的来源（宿主据此如实回话；不是授权凭据）。
+type CancelSource string
+
+const (
+	// CancelSourceExplicit：用户这一轮点名了运行（命令值或 run_id 槽位）。
+	CancelSourceExplicit CancelSource = "explicit"
+	// CancelSourceSession：当前会话绑定动作的运行上下文（意图会话）。
+	CancelSourceSession CancelSource = "session"
+)
+
+// CancelTarget 是「取消」的裁决靶子。
+//
+// 纪律：RunID 为空就是「没有唯一靶子」——宿主必须如实澄清，绝不猜一个
+// 「大概是它」；带靶子的裁决也只声明「要取消谁」，不代表已获授权。
+type CancelTarget struct {
+	// RunID 是要取消的运行（空 = 待宿主澄清）。
+	RunID  string
+	Source CancelSource
+	// Intent/Action 是靶子的来源上下文（会话绑定的意图与动作；审计与回话用）。
+	Intent string
+	Action string
+	// Candidates 是库层随取消命令给出的候选（如有）：如实透出，不做取舍。
+	Candidates []string
+}
+
+// SessionRun 是会话（意图会话）里绑定的运行上下文，由宿主注入给 Env。
+type SessionRun struct {
+	RunID  string
+	Intent string
+	Action string
+}
+
+// Clarification 是「业务动作未派发，需要向用户澄清」的诉求。
+// 槽位缺失与非法都带结构化原因（key + reason + question），
+// 宿主据此渲染澄清话术或转成回合提示，不再自行猜测。
+type Clarification struct {
+	Needed   bool
+	Question string
+	Missing  []intentgate.SlotQuestion
+	Invalid  []intentgate.SlotDefect
+	// Command 是被拦下的动作 ID（诊断与审计用，未派发）。
+	Command string
+}
+
 // Decision 是一次路由裁决。
 type Decision struct {
 	Kind       Kind
@@ -41,8 +105,19 @@ type Decision struct {
 	Blueprint  string
 	Slots      map[string]string
 	Missing    []intentgate.SlotQuestion
-	Reason     string // 回落 turn 的原因（显式声明不可解析时）
-	StartFound bool   // 是否存在 Start 命令（runmgr 转轨判定用）
+	Invalid    []intentgate.SlotDefect
+	Risk       string // 权威意图声明的风险档（low/medium/high）
+	Reason     string // 回落 turn 的原因（显式声明不可解析、准入未过、取消无唯一靶子等）
+	StartFound bool   // 本轮是否会启动动作（runmgr 转轨判定用；取消裁决下恒为 false——取消与启动互斥）
+	// Cancel 非 nil 时本轮是「取消」意图的裁决（Kind=KindCancel）。
+	Cancel *CancelTarget
+	// RequiresConfirm 是意图声明的显式确认要求（与命令自身的 danger 分级正交，
+	// 本包只透传，不替代 cmdbus 的高危确认收口）。
+	RequiresConfirm bool
+	// Clarification 非空时业务动作未派发（Needed=true 时必有槽位原因）。
+	Clarification Clarification
+	// Unsupported 是本次识别里宿主不消费的库层命令种类（如 cancel/set_slot）。
+	Unsupported []string
 }
 
 // Env 是路由裁决的环境解析器（由调用方注入；nil 视为不可解析）。
@@ -50,25 +125,73 @@ type Env struct {
 	HasCommand  func(id string) bool
 	WorkflowFor func(intentID string) (core.WorkflowDef, bool)
 	SquadReady  bool
+	// SessionRun 返回当前会话绑定动作的运行上下文（取消靶子的会话来源；
+	// 宿主从意图会话注入）。nil 或 false = 会话没有给出靶子——绝不臆造。
+	SessionRun func() (SessionRun, bool)
+}
+
+// unconsumedCommandKinds 是本包不派发的库层命令种类。
+//
+// 命中即不派发业务动作：把「改槽」当成「启动」是比不响更糟的错配。
+// set_slot/change_slot 已由宿主的会话状态机消费（internal/intentsession，
+// A1/U-A1b）——它们改的是会话里挂起动作的槽位；cancel 自 U-A1c 起由宿主
+// 按「取消既有动作」消费（解靶子 → 宿主派发既有取消路径），故不在本表。
+// chitchat/handoff 由宿主自行处理。
+var unconsumedCommandKinds = map[string]bool{
+	string(intentgate.CommandSetSlot):    true,
+	string(intentgate.CommandChangeSlot): true,
+	string(intentgate.CommandHandoff):    true,
+	string(intentgate.CommandChitchat):   true,
 }
 
 // Decide 裁决一次识别结果。规则：
 //  1. 非 matched（fallback/guard/ambiguous 经闸门折叠后）→ turn。
-//  2. 找到首个 Start 命令；没有时按 TopID 走 auto（兼容兜底，与现网一致）。
-//  3. 按 ActionRef.Kind 解析：command→命令总线；workflow→工作流；
-//     blueprint→squad 决策；handler/auto→命令总线 > 工作流 > turn。
+//  2. 出现 cancel 命令 → 取消裁决（KindCancel）：解出唯一靶子，宿主据此派发
+//     既有取消动作；同句的 Start 一并不派发（取消与启动互斥）。
+//  3. 出现宿主不消费的库层命令（set_slot/handoff/…）→ turn，并如实记录
+//     Unsupported 与 Reason（不假装支持，也不派发同句的 Start）。
+//  4. 找到首个 Start 命令；没有时按 TopID（或显式 action 声明）走 auto
+//     （兼容兜底，与现网一致）。
+//  5. 按 ActionRef.Kind 解析：command→命令总线（先过槽位准入）；
+//     workflow→工作流（草稿，缺槽照常启动）；blueprint→squad 决策；
+//     handler/auto→命令总线 > 工作流 > turn。
 func Decide(res intentgate.MatchResult, env Env) Decision {
-	d := Decision{Kind: KindTurn, Slots: res.Slots, Missing: res.Missing}
+	d := Decision{Kind: KindTurn, Slots: res.Slots, Missing: res.Missing, Invalid: res.Invalid,
+		Risk: res.Risk, RequiresConfirm: res.RequiresConfirm}
 	if res.Branch != "matched" {
 		return d
 	}
-	var start *intentgate.Command
+	d.Unsupported = unconsumedKinds(res.Commands)
+	var start, clarify, cancel *intentgate.Command
 	for i := range res.Commands {
-		if res.Commands[i].Kind == intentgate.CommandStart {
-			start = &res.Commands[i]
-			break
+		switch res.Commands[i].Kind {
+		case intentgate.CommandStart:
+			if start == nil {
+				start = &res.Commands[i]
+			}
+		case intentgate.CommandClarify:
+			if clarify == nil {
+				clarify = &res.Commands[i]
+			}
+		case intentgate.CommandCancel:
+			if cancel == nil {
+				cancel = &res.Commands[i]
+			}
 		}
 	}
+	if cancel != nil {
+		// 取消优先于同句的其它命令：用户这一轮要的是「取消」，不是「顺便
+		// 启动」。StartFound 刻意不置位——本轮不会启动任何动作，runmgr 的
+		// 转轨判定因此保持与取消前一致。
+		return d.decideCancel(*cancel, res, env)
+	}
+	if len(d.Unsupported) > 0 {
+		d.Reason = "宿主未消费库层命令：" + strings.Join(d.Unsupported, "、")
+		if clarify != nil {
+			d.Clarification = clarificationFrom("", res, clarify)
+		}
+		return d
+	}
 	action := intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: res.ID}
 	if start != nil {
 		d.StartFound = true
@@ -76,19 +199,19 @@ func Decide(res intentgate.MatchResult, env Env) Decision {
 		if len(start.Slots) > 0 {
 			d.Slots = start.Slots
 		}
+	} else if res.Action != nil {
+		action = *res.Action
 	}
 	switch action.Kind {
 	case intentgate.ActionCommand:
 		if env.HasCommand != nil && env.HasCommand(action.ID) {
-			d.Kind, d.CommandID = KindCommand, action.ID
-			return d
+			return d.dispatchCommand(action.ID, res, clarify)
 		}
 		d.Reason = "声明的命令不存在：" + action.ID
 	case intentgate.ActionWorkflow:
 		if env.WorkflowFor != nil {
 			if def, ok := env.WorkflowFor(action.ID); ok {
-				d.Kind, d.Workflow = KindWorkflow, def
-				return d
+				return d.startWorkflowDraft(def)
 			}
 		}
 		d.Reason = "声明的工作流未注册：" + action.ID
@@ -100,15 +223,159 @@ func Decide(res intentgate.MatchResult, env Env) Decision {
 		d.Reason = "声明的小队未启用：" + action.ID
 	default: // auto / handler
 		if env.HasCommand != nil && env.HasCommand(action.ID) {
-			d.Kind, d.CommandID = KindCommand, action.ID
-			return d
+			return d.dispatchCommand(action.ID, res, clarify)
 		}
 		if env.WorkflowFor != nil {
 			if def, ok := env.WorkflowFor(action.ID); ok {
-				d.Kind, d.Workflow = KindWorkflow, def
-				return d
+				return d.startWorkflowDraft(def)
 			}
 		}
 	}
 	return d
 }
+
+// decideCancel 裁决「取消」：解出唯一靶子，把「取消哪一个运行」交给宿主。
+//
+// 靶子优先级（确定性，用户点名优先于会话绑定）：
+//  1. 取消命令自身的值 / 本轮槽位里的运行号——用户明确指认；
+//  2. 当前会话绑定动作的运行上下文（Env.SessionRun，宿主从意图会话读）。
+//
+// 解不出唯一靶子时 RunID 留空并写明原因：宿主据此如实澄清，绝不猜。
+// 本包不派发、不确认：执行授权始终由宿主的既有取消路径收口。
+// 同句里其余未消费的库层命令（如 set_slot）仍如实记在 Unsupported 里供审计，
+// 但既不派发也不参与靶子解算——取消与启动互斥。
+func (d Decision) decideCancel(cmd intentgate.Command, res intentgate.MatchResult, env Env) Decision {
+	d.Kind = KindCancel
+	t := &CancelTarget{Intent: res.ID, Candidates: append([]string(nil), cmd.Candidates...)}
+	if runID := explicitRunID(res, cmd); runID != "" {
+		t.RunID, t.Source = runID, CancelSourceExplicit
+	} else if env.SessionRun != nil {
+		if bound, ok := env.SessionRun(); ok && strings.TrimSpace(bound.RunID) != "" {
+			t.RunID, t.Source, t.Action = strings.TrimSpace(bound.RunID), CancelSourceSession, bound.Action
+			if t.Intent == "" {
+				t.Intent = bound.Intent
+			}
+		}
+	}
+	if t.RunID == "" {
+		d.Reason = "取消没有唯一靶子：原文未指明运行，当前会话也没有绑定运行"
+	}
+	d.Cancel = t
+	return d
+}
+
+// explicitRunID 取消命令里点名的运行：命令自身的值优先，其次本轮槽位里的
+// 运行号（键序固定，结果与 map 迭代序无关）。
+func explicitRunID(res intentgate.MatchResult, cmd intentgate.Command) string {
+	if v := strings.TrimSpace(cmd.Value); v != "" {
+		return v
+	}
+	for _, key := range []string{"run_id", "runId", "run"} {
+		if v := strings.TrimSpace(res.Slots[key]); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// dispatchCommand 派发可执行业务动作前的最后一道闸：槽位必须齐全且通过权威校验。
+// 未就绪时不碰业务动作，改为带结构化原因的澄清诉求（Kind 留在 turn）。
+func (d Decision) dispatchCommand(id string, res intentgate.MatchResult, clarify *intentgate.Command) Decision {
+	if !res.Complete() {
+		d.Clarification = clarificationFrom(id, res, clarify)
+		d.Reason = "槽位未就绪，未派发命令：" + id
+		return d
+	}
+	d.Kind, d.CommandID = KindCommand, id
+	return d
+}
+
+// startWorkflowDraft 工作流是收集槽位的草稿：缺失与非法都不阻断启动
+// （非法值本就进不了 Slots），缺失清单随 Decision 透出，由流程自身追问。
+func (d Decision) startWorkflowDraft(def core.WorkflowDef) Decision {
+	d.Kind, d.Workflow = KindWorkflow, def
+	return d
+}
+
+// unconsumedKinds 列出命令列表里宿主不消费的种类（按首次出现序，确定性）。
+func unconsumedKinds(cmds []intentgate.Command) []string {
+	var out []string
+	for _, c := range cmds {
+		if !unconsumedCommandKinds[string(c.Kind)] {
+			continue
+		}
+		if contains(out, string(c.Kind)) {
+			continue
+		}
+		out = append(out, string(c.Kind))
+	}
+	return out
+}
+
+func contains(list []string, v string) bool {
+	for _, x := range list {
+		if x == v {
+			return true
+		}
+	}
+	return false
+}
+
+// clarificationFrom 组装澄清诉求：优先用 spec 声明的建议提问，
+// 缺失时回落库层 clarify 命令里的 Question，再缺就按缺陷键列一句兜底。
+func clarificationFrom(id string, res intentgate.MatchResult, clarify *intentgate.Command) Clarification {
+	c := Clarification{Needed: true, Command: id,
+		Missing: append([]intentgate.SlotQuestion(nil), res.Missing...),
+		Invalid: append([]intentgate.SlotDefect(nil), res.Invalid...)}
+	if len(c.Missing) > 0 {
+		c.Question = strings.TrimSpace(c.Missing[0].Question)
+	}
+	if c.Question == "" && len(c.Invalid) > 0 {
+		c.Question = strings.TrimSpace(c.Invalid[0].Question)
+	}
+	if clarify != nil {
+		if c.Question == "" {
+			c.Question = strings.TrimSpace(clarify.Question)
+		}
+		// 库层 clarify 的 Missing 是缺失与非法键的合并；补齐宿主侧没有投影的键。
+		for _, k := range clarify.Missing {
+			if defectKeyKnown(c, k) {
+				continue
+			}
+			c.Missing = append(c.Missing, intentgate.SlotQuestion{Key: k, Question: k})
+		}
+	}
+	if c.Question == "" {
+		c.Question = fallbackQuestion(c)
+	}
+	return c
+}
+
+func defectKeyKnown(c Clarification, key string) bool {
+	for _, m := range c.Missing {
+		if m.Key == key {
+			return true
+		}
+	}
+	for _, iv := range c.Invalid {
+		if iv.Key == key {
+			return true
+		}
+	}
+	return false
+}
+
+// fallbackQuestion 没有任何声明提问时的兜底话术：按缺失在前、非法在后列键。
+func fallbackQuestion(c Clarification) string {
+	var keys []string
+	for _, m := range c.Missing {
+		keys = append(keys, m.Key)
+	}
+	for _, iv := range c.Invalid {
+		keys = append(keys, iv.Key)
+	}
+	if len(keys) == 0 {
+		return ""
+	}
+	return "请补充：" + strings.Join(keys, "、")
+}

internal/route/route_test.go

@@ -81,3 +81,283 @@ func TestSlotsFromStartCommand(t *testing.T) {
 		t.Fatalf("slots = %v", d.Slots)
 	}
 }
+
+// ---- F09：槽位准入——业务动作必须齐全且合法，否则转澄清 ----
+
+func matchedCommand(action intentgate.ActionRef) intentgate.MatchResult {
+	return intentgate.MatchResult{Branch: "matched", ID: action.ID,
+		Commands: []intentgate.Command{startCmd(action)}}
+}
+
+func hasCommandEnv() Env { return Env{HasCommand: func(string) bool { return true }} }
+
+func TestMissingSlotsBlockCommandDispatch(t *testing.T) {
+	in := matchedCommand(intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: "demo.brief"})
+	in.Missing = []intentgate.SlotQuestion{{Key: "topic", Question: "主题是什么？"}}
+	d := Decide(in, hasCommandEnv())
+	if d.Kind != KindTurn || d.CommandID != "" {
+		t.Fatalf("缺必填槽位不得派发命令：%+v", d)
+	}
+	if !d.Clarification.Needed || d.Clarification.Command != "demo.brief" {
+		t.Fatalf("澄清诉求缺失：%+v", d.Clarification)
+	}
+	if d.Clarification.Question != "主题是什么？" || len(d.Clarification.Missing) != 1 {
+		t.Fatalf("澄清提问未透传：%+v", d.Clarification)
+	}
+	if d.Reason == "" || !d.StartFound {
+		t.Fatalf("回落原因或 Start 标记缺失：%+v", d)
+	}
+}
+
+func TestInvalidSlotsBlockCommandWithReason(t *testing.T) {
+	in := matchedCommand(intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.mode"})
+	in.Invalid = []intentgate.SlotDefect{{Key: "mode", Reason: "value not in enum", Question: "要哪种模式？", Invalid: true}}
+	d := Decide(in, hasCommandEnv())
+	if d.Kind != KindTurn || d.CommandID != "" {
+		t.Fatalf("非法槽位不得派发命令：%+v", d)
+	}
+	if len(d.Clarification.Invalid) != 1 || d.Clarification.Invalid[0].Reason != "value not in enum" {
+		t.Fatalf("非法原因未透传：%+v", d.Clarification)
+	}
+	if d.Clarification.Question != "要哪种模式？" {
+		t.Fatalf("澄清提问未透传：%+v", d.Clarification)
+	}
+}
+
+func TestCompleteSlotsDispatchCommand(t *testing.T) {
+	in := matchedCommand(intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: "demo.brief"})
+	in.Slots = map[string]string{"topic": "核能"}
+	in.Risk, in.RequiresConfirm = "high", true
+	d := Decide(in, hasCommandEnv())
+	if d.Kind != KindCommand || d.CommandID != "demo.brief" {
+		t.Fatalf("完整合法槽位应派发：%+v", d)
+	}
+	if d.Risk != "high" || !d.RequiresConfirm || d.Clarification.Needed {
+		t.Fatalf("风险元数据未透传或误报澄清：%+v", d)
+	}
+}
+
+// 工作流是「边收集边执行」的草稿：缺失清单照常启动，由流程自身追问。
+func TestWorkflowDraftStartsWhileGatheringSlots(t *testing.T) {
+	in := matchedCommand(intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: "demo.brief"})
+	in.Missing = []intentgate.SlotQuestion{{Key: "topic", Question: "主题是什么？"}}
+	d := Decide(in, Env{
+		HasCommand:  func(string) bool { return false },
+		WorkflowFor: func(string) (core.WorkflowDef, bool) { return core.WorkflowDef{ID: "wf"}, true },
+	})
+	if d.Kind != KindWorkflow || d.Workflow.ID != "wf" {
+		t.Fatalf("工作流草稿应照常启动：%+v", d)
+	}
+	if len(d.Missing) != 1 || d.Clarification.Needed {
+		t.Fatalf("缺失清单应随决策透出：%+v", d)
+	}
+}
+
+// 显式的取消/改槽命令不得被静默当成已支持：改槽回落普通回合，如实记录；
+// 取消已经是宿主可执行的既有动作（U-A1c），但解不出靶子时绝不假装已取消。
+func TestUnsupportedLibraryCommandsAreNotClaimed(t *testing.T) {
+	in := intentgate.MatchResult{Branch: "matched", ID: "demo.brief", Commands: []intentgate.Command{
+		{Kind: intentgate.CommandStart, Action: intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: "demo.brief"}},
+		{Kind: intentgate.CommandCancel, Target: "demo.brief"},
+	}}
+	d := Decide(in, hasCommandEnv())
+	if d.Kind != KindCancel || d.CommandID != "" {
+		t.Fatalf("取消不得被当成新业务动作派发：%+v", d)
+	}
+	if len(d.Unsupported) != 0 {
+		t.Fatalf("取消已由宿主消费，不得再记为未消费：%+v", d.Unsupported)
+	}
+	if d.Cancel == nil || d.Cancel.RunID != "" || d.Reason == "" {
+		t.Fatalf("没有唯一靶子时必须如实留空并说明原因：%+v", d)
+	}
+	// 只有改槽命令时同样回落，且不得声称支持。
+	only := intentgate.MatchResult{Branch: "matched", ID: "demo.brief", Commands: []intentgate.Command{
+		{Kind: intentgate.CommandSetSlot, Name: "topic", Value: "核能"},
+	}}
+	got := Decide(only, hasCommandEnv())
+	if got.Kind != KindTurn || got.CommandID != "" || len(got.Unsupported) != 1 {
+		t.Fatalf("set_slot 不得被当成可派发：%+v", got)
+	}
+}
+
+// 澄清提问优先用 spec 声明，缺失时回落库层 clarify 命令，最后按键名兜底。
+func TestClarificationQuestionSources(t *testing.T) {
+	in := matchedCommand(intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.mode"})
+	in.Missing = []intentgate.SlotQuestion{{Key: "mode"}}
+	in.Commands = append(in.Commands, intentgate.Command{Kind: intentgate.CommandClarify, Question: "要哪种模式？"})
+	if q := Decide(in, hasCommandEnv()).Clarification.Question; q != "要哪种模式？" {
+		t.Fatalf("库层澄清提问未用上：%q", q)
+	}
+	in.Commands = in.Commands[:1]
+	if q := Decide(in, hasCommandEnv()).Clarification.Question; q != "请补充：mode" {
+		t.Fatalf("兜底提问：%q", q)
+	}
+}
+
+// 旧消费方（命令列表为空）仍按 TopID 走 auto，且必须槽位完整。
+func TestLegacyAutoStillNeedsCompleteSlots(t *testing.T) {
+	in := intentgate.MatchResult{Branch: "matched", ID: "demo.x",
+		Missing: []intentgate.SlotQuestion{{Key: "topic", Question: "主题是什么？"}}}
+	d := Decide(in, hasCommandEnv())
+	if d.Kind != KindTurn || d.CommandID != "" || !d.Clarification.Needed {
+		t.Fatalf("旧路径也必须过槽位准入：%+v", d)
+	}
+}
+
+// A1/U-A1b：set_slot/change_slot 由宿主的会话状态机消费（internal/intentsession），
+// 但本包的公开契约不变——落槽不是可派发的动作。
+func TestSessionCommandsStayUnsupportedForDispatch(t *testing.T) {
+	start := intentgate.Command{Kind: intentgate.CommandStart,
+		Action: intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: "demo.brief"},
+		Slots:  map[string]string{"topic": "核能"}}
+	sessionKinds := []struct {
+		command intentgate.Command
+		kind    string
+	}{
+		{intentgate.Command{Kind: intentgate.CommandSetSlot, Name: "topic", Value: "电机"}, string(intentgate.CommandSetSlot)},
+		{intentgate.Command{Kind: intentgate.CommandChangeSlot, Name: "topic", Value: "电机"}, string(intentgate.CommandChangeSlot)},
+	}
+	for _, item := range sessionKinds {
+		in := intentgate.MatchResult{Branch: "matched", ID: "demo.brief",
+			Commands: []intentgate.Command{start, item.command}}
+		d := Decide(in, hasCommandEnv())
+		if d.Kind != KindTurn || d.CommandID != "" {
+			t.Fatalf("%s 不得被当成动作派发：%+v", item.kind, d)
+		}
+		if len(d.Unsupported) != 1 || d.Unsupported[0] != item.kind || d.Reason == "" {
+			t.Fatalf("%s 未如实记录为宿主已消费但不派发：%+v", item.kind, d)
+		}
+	}
+	// 取消是既有动作（U-A1c）：它派发的是「取消某个运行」，不是同句里的
+	// demo.brief；靶子缺失时留给宿主澄清，绝不假装已取消。
+	cancel := intentgate.MatchResult{Branch: "matched", ID: "demo.brief",
+		Commands: []intentgate.Command{start, {Kind: intentgate.CommandCancel, Target: "demo.brief"}}}
+	if d := Decide(cancel, hasCommandEnv()); d.Kind != KindCancel || d.CommandID != "" || d.Cancel == nil {
+		t.Fatalf("取消必须走取消裁决，不得派发别的新动作：%+v", d)
+	}
+	if d := Decide(cancel, hasCommandEnv()); d.StartFound {
+		t.Fatalf("取消轮不得声称会启动动作（runmgr 转轨判定依赖此位）：%+v", d)
+	}
+}
+
+// ---- A1/U-A1c：取消路由——解出唯一靶子，否则如实留给宿主澄清 ----
+
+// sessionEnv 是「会话里绑定了一个运行」的路由环境。
+func sessionEnv(runID string) Env {
+	return Env{SessionRun: func() (SessionRun, bool) {
+		return SessionRun{RunID: runID, Intent: "demo.run-cancel", Action: "demo.run-cancel"}, runID != ""
+	}}
+}
+
+func cancelResult(slots map[string]string, cancel intentgate.Command) intentgate.MatchResult {
+	return intentgate.MatchResult{Branch: "matched", ID: "demo.task-cancel", Slots: slots,
+		Commands: []intentgate.Command{cancel}}
+}
+
+func TestCancelResolvesTargetFromTextAndSession(t *testing.T) {
+	cases := []struct {
+		name   string
+		in     intentgate.MatchResult
+		env    Env
+		runID  string
+		source CancelSource
+	}{
+		{
+			name:   "命令点名",
+			in:     cancelResult(nil, intentgate.Command{Kind: intentgate.CommandCancel, Value: "run_7"}),
+			env:    hasCommandEnv(),
+			runID:  "run_7",
+			source: CancelSourceExplicit,
+		},
+		{
+			name:   "槽位里的运行号",
+			in:     cancelResult(map[string]string{"run_id": "run_8"}, intentgate.Command{Kind: intentgate.CommandCancel}),
+			env:    hasCommandEnv(),
+			runID:  "run_8",
+			source: CancelSourceExplicit,
+		},
+		{
+			name:   "会话绑定的运行",
+			in:     cancelResult(nil, intentgate.Command{Kind: intentgate.CommandCancel}),
+			env:    sessionEnv("run_9"),
+			runID:  "run_9",
+			source: CancelSourceSession,
+		},
+		{
+			// 用户点名优先于会话绑定（确定性：显式意图高于隐式上下文）。
+			name: "显式优先于会话",
+			in: cancelResult(map[string]string{"run_id": "run_8"},
+				intentgate.Command{Kind: intentgate.CommandCancel}),
+			env:    sessionEnv("run_9"),
+			runID:  "run_8",
+			source: CancelSourceExplicit,
+		},
+	}
+	for _, c := range cases {
+		d := Decide(c.in, c.env)
+		if d.Kind != KindCancel || d.Cancel == nil {
+			t.Fatalf("%s：取消未走取消裁决：%+v", c.name, d)
+		}
+		if d.Cancel.RunID != c.runID || d.Cancel.Source != c.source {
+			t.Fatalf("%s：靶子/来源 = %q/%q；want %q/%q", c.name, d.Cancel.RunID, d.Cancel.Source, c.runID, c.source)
+		}
+		if d.CommandID != "" || d.Reason != "" || d.Clarification.Needed {
+			t.Fatalf("%s：解出靶子后不得再回落/再澄清：%+v", c.name, d)
+		}
+		if d.Cancel.Intent != "demo.task-cancel" {
+			t.Fatalf("%s：意图 id 未透传：%+v", c.name, d.Cancel)
+		}
+	}
+}
+
+// 没有唯一靶子（无绑定、无点名）时如实留空，绝不替用户猜一个。
+func TestCancelWithoutTargetAsksForClarification(t *testing.T) {
+	envs := map[string]Env{
+		"无环境":    {},
+		"无绑定":    sessionEnv(""),
+		"绑定为空运行": {SessionRun: func() (SessionRun, bool) { return SessionRun{}, true }},
+	}
+	for name, env := range envs {
+		d := Decide(cancelResult(nil, intentgate.Command{Kind: intentgate.CommandCancel}), env)
+		if d.Kind != KindCancel {
+			t.Fatalf("%s：没有靶子也应给出取消裁决（宿主据此澄清）：%+v", name, d)
+		}
+		if d.Cancel.RunID != "" || d.Reason == "" {
+			t.Fatalf("%s：无靶子必须如实留空并写明原因：%+v", name, d)
+		}
+		if d.CommandID != "" {
+			t.Fatalf("%s：取消轮不得派发别的新动作：%+v", name, d)
+		}
+	}
+}
+
+// 库层随取消给出的候选如实透出（不在路由层做取舍）。
+func TestCancelKeepsLibraryCandidates(t *testing.T) {
+	d := Decide(cancelResult(nil, intentgate.Command{Kind: intentgate.CommandCancel,
+		Candidates: []string{"run_1", "run_2"}}), Env{})
+	if d.Cancel == nil || len(d.Cancel.Candidates) != 2 {
+		t.Fatalf("候选未透传：%+v", d.Cancel)
+	}
+	if d.Cancel.RunID != "" {
+		t.Fatalf("多个候选时不得替用户选一个：%+v", d.Cancel)
+	}
+}
+
+// 非 matched 分支的取消不产生任何靶子（与既有回落逐字节一致）。
+func TestCancelIgnoredOnNonMatched(t *testing.T) {
+	for _, branch := range []string{"fallback", "guard_hit", "ambiguous", "expectation_hit"} {
+		d := Decide(intentgate.MatchResult{Branch: branch, ID: "demo.task-cancel",
+			Commands: []intentgate.Command{{Kind: intentgate.CommandCancel, Value: "run_7"}}}, sessionEnv("run_9"))
+		if d.Kind != KindTurn || d.Cancel != nil {
+			t.Fatalf("%s：非命中不得产生取消裁决：%+v", branch, d)
+		}
+	}
+}
+
+// Env 未接线会话（nil hook）时行为与 U-A1b 一致：没有靶子，如实澄清。
+func TestCancelWithoutSessionHookKeepsLegacyContract(t *testing.T) {
+	d := Decide(cancelResult(nil, intentgate.Command{Kind: intentgate.CommandCancel}), Env{})
+	if d.Cancel == nil || d.Cancel.RunID != "" {
+		t.Fatalf("无会话接线不得臆造靶子：%+v", d)
+	}
+}

internal/rundiag/rundiag.go

@@ -0,0 +1,488 @@
+// Package rundiag 把单次 run 的诊断证据聚合成一份只读结论：卡在哪、谁负责、
+// 为什么在等、最后一个稳定检查点、已知副作用、下一步动作。
+//
+// 全包统一口径（任务卡 A2 的契约）：
+//   - 只读派生：Build 是纯函数，Gather 只跑 SELECT；本包不提供任何写路径。
+//   - 证据优先于推断：状态只由已落库的记录驱动。读不到就降级为 unknown + note，
+//     读不到隔离记录时更按 fail-closed 处理（不声称"可以安全重试"）。
+//   - 「没有记录」≠「没有发生」：side_effects 为空必须带 note，说明这是"未记录"
+//     而不是"未发生"。
+//   - 归属边界：HITL 决策卡、危险命令确认卡、命令审计信封都按 owner + 会话归属，
+//     其中决策卡与确认卡表里根本没有 run 列，审计信封虽有 runId 字段但宿主总线
+//     当前不写。因此"归到这个 run"是调用方按签发时间窗做的有界推断，报告以
+//     note 标出，绝不把会话里更早的记录算成本次 run 的副作用。
+package rundiag
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+// responsibility.state 的取值域（任务卡固定）。
+const (
+	StateRunning             = "running"
+	StateWaitingHITL         = "waiting_hitl"
+	StateConfirmationPending = "confirmation_pending"
+	StateRecoveryHold        = "recovery_hold"
+	StateReconciling         = "reconciling"
+	StateFailed              = "failed"
+	StateCompleted           = "completed"
+	StateUnknown             = "unknown"
+)
+
+// responsibility.role：这一刻该谁动。
+const (
+	RoleRunner         = "runner"          // 执行器自己在推进
+	RoleHuman          = "human"           // 等人裁决（HITL / 危险命令确认）
+	RoleOperationOwner = "operation-owner" // 等副作用责任人对账与解除
+	RoleNone           = "none"            // 没有待办责任方
+)
+
+// next_step.action 的取值域。
+const (
+	ActionConfirmCard               = "confirm_card"
+	ActionReleaseRecoveryHold       = "release_recovery_hold"
+	ActionSafeRetry                 = "safe_retry"
+	ActionNeedsManualReconciliation = "needs_manual_reconciliation"
+	ActionNone                      = "none"
+)
+
+// side_effects[].kind：证据来源类别。
+const (
+	EffectOperation    = "operation"     // 命令审计信封（U7b 对账记录）
+	EffectRecoveryHold = "recovery_hold" // 恢复隔离行（U3b 的"副作用未知"证据）
+)
+
+// 读取上界：诊断是给人和值班看的，不是全量导出。
+const (
+	maxSideEffects = 50
+	maxAuditScan   = 200 // 审计信封按会话+时间窗有界扫描
+	maxConfirms    = 50
+)
+
+// Report 是诊断响应（JSON 契约，字段名用任务卡给定的 snake_case）。
+type Report struct {
+	Run            RunSummary     `json:"run"`
+	Responsibility Responsibility `json:"responsibility"`
+	LastCheckpoint *Checkpoint    `json:"last_checkpoint"` // 无记录时为 null（不编造）
+	SideEffects    []SideEffect   `json:"side_effects"`    // 恒为数组：空数组 = 未记录到
+	NextStep       NextStep       `json:"next_step"`
+	Notes          []string       `json:"notes,omitempty"` // 降级与边界说明
+}
+
+// RunSummary 是 run 自身的身份与时间戳。updated_at 的口径：已终态取 ended_at，
+// 未终态取最后一个已持久化事件的时间；两者都没有则为 null（并在 notes 说明）。
+type RunSummary struct {
+	ID           string  `json:"id"`
+	Status       string  `json:"status"`
+	Kind         string  `json:"kind,omitempty"`
+	Phase        string  `json:"phase,omitempty"`
+	Owner        string  `json:"owner"`
+	Project      string  `json:"project"`
+	Conversation string  `json:"conversation"`
+	CreatedAt    string  `json:"created_at"`
+	UpdatedAt    *string `json:"updated_at"`
+}
+
+// Responsibility 回答"卡在哪、谁负责、为什么等、从什么时候开始等"。
+type Responsibility struct {
+	State      string `json:"state"`
+	Role       string `json:"role"`
+	WaitReason string `json:"wait_reason"`
+	Since      string `json:"since,omitempty"` // 进入该状态的时间；存储没记就省略
+}
+
+// Checkpoint 指向最后一个稳定落盘点（事件流上的 seq 可直接作重放游标）。
+type Checkpoint struct {
+	ID   string `json:"id"`
+	At   string `json:"at"`
+	Type string `json:"type"`
+}
+
+// SideEffect 是一条已记录的外部副作用证据。operation 行为命令回执对账记录；
+// recovery_hold 行是 U3b 落下的"副作用结果未知"隔离证据（state = held/released）。
+type SideEffect struct {
+	Kind        string `json:"kind"`
+	OperationID string `json:"operation_id,omitempty"`
+	CommandID   string `json:"command_id,omitempty"`
+	State       string `json:"state"`
+	At          string `json:"at,omitempty"`
+	ReleasedAt  string `json:"released_at,omitempty"`
+}
+
+// NextStep 是唯一建议的下一步动作（诊断面只建议，不执行）。
+type NextStep struct {
+	Action string `json:"action"`
+	CardID string `json:"card_id,omitempty"` // confirm_card 可解析时给出卡 ID
+	Reason string `json:"reason"`
+}
+
+// Source 是诊断所需的只读端口（*store.Store 直接满足；测试可替身）。
+type Source interface {
+	GetRecoveryHold(runID string) (store.RecoveryHold, error)
+	ActiveHITLCardsByRun(runID string) ([]core.HITLCard, error)
+	PendingHumanDecisionsByConversation(owner, conversationID string, now time.Time) ([]store.HumanDecision, error)
+	ListOwnerPendingConfirms(owner string, limit int) ([]store.PendingConfirm, error)
+	LastRunCheckpoint(conversationID, runID string) (store.RunCheckpoint, bool, error)
+	ListAudits(owner, conversationID string, limit int) ([]agentcommand.AuditEnvelope, error)
+}
+
+// Evidence 是 Build 的全部输入（合成数据即可表驱动测试，无需真实存储）。
+type Evidence struct {
+	Run core.Run
+
+	Hold        *store.RecoveryHold // nil = 没有隔离行；HoldUnknown = 读失败
+	HoldUnknown bool
+	Cards       []core.HITLCard        // 该 run 未关闭的 HITL 卡
+	Decisions   []store.HumanDecision  // 会话内未过期的 pending 决策卡
+	Confirms    []store.PendingConfirm // owner 名下未确认的危险命令挂起行
+	Checkpoint  *store.RunCheckpoint   // 最后一个已持久化事件
+	Audits      []agentcommand.AuditEnvelope
+	Notes       []string
+}
+
+// Gather 只读地把一个 run 的证据读齐。任何一条可选查询失败都不让整个诊断失败：
+// 失败降级为 note；隔离记录读不到按 fail-closed 标记（HoldUnknown），因为"读不到
+// hold"绝不能被读成"没有 hold"。
+func Gather(src Source, run core.Run, now time.Time) Evidence {
+	ev := Evidence{Run: run}
+	if src == nil {
+		ev.HoldUnknown = true
+		return ev.withNote("diagnostics source unavailable; responsibility is fail-closed unknown")
+	}
+	owner := string(run.Owner)
+	conversation := string(run.ConversationID)
+
+	hold, err := src.GetRecoveryHold(string(run.ID))
+	switch {
+	case err == nil:
+		ev.Hold = &hold
+	case errors.Is(err, store.ErrNotFound):
+		// 没有隔离行是正常态，不记 note。
+	default:
+		ev.HoldUnknown = true
+		ev = ev.withNote("recovery hold unreadable: " + err.Error())
+	}
+
+	cards, err := src.ActiveHITLCardsByRun(string(run.ID))
+	if err != nil {
+		ev = ev.withNote("hitl cards unreadable: " + err.Error())
+	} else {
+		ev.Cards = cards
+	}
+
+	decisions, err := src.PendingHumanDecisionsByConversation(owner, conversation, now)
+	if err != nil {
+		ev = ev.withNote("human decisions unreadable: " + err.Error())
+	} else {
+		ev.Decisions = decisions
+	}
+
+	confirms, err := src.ListOwnerPendingConfirms(owner, maxConfirms)
+	if err != nil {
+		ev = ev.withNote("pending confirmations unreadable: " + err.Error())
+	} else {
+		ev.Confirms = confirms
+	}
+
+	cp, ok, err := src.LastRunCheckpoint(conversation, string(run.ID))
+	switch {
+	case err != nil:
+		ev = ev.withNote("last checkpoint unreadable: " + err.Error())
+	case ok:
+		ev.Checkpoint = &cp
+	}
+
+	audits, err := src.ListAudits(owner, conversation, maxAuditScan)
+	if err != nil {
+		ev = ev.withNote("command audit unreadable: " + err.Error())
+	} else {
+		ev.Audits = audits
+	}
+	return ev
+}
+
+// Build 把证据聚合成诊断结论（纯函数，不读写任何状态）。
+func Build(ev Evidence) Report {
+	rep := Report{Run: runSummary(ev), SideEffects: []SideEffect{}}
+	if ev.Checkpoint != nil {
+		rep.LastCheckpoint = &Checkpoint{ID: fmt.Sprintf("%d", ev.Checkpoint.Seq), At: ev.Checkpoint.TS, Type: ev.Checkpoint.Type}
+	}
+	rep.SideEffects = sideEffects(ev)
+	rep.Notes = append([]string(nil), ev.Notes...)
+
+	card := waitingCard(ev)
+	decision := waitingDecision(ev)
+	confirm := waitingConfirm(ev)
+
+	switch {
+	case ev.HoldUnknown:
+		// 隔离记录读不到：不猜没有 hold，直接 unknown，且不给"安全重试"。
+		rep.Notes = append(rep.Notes, "recovery hold state unknown; treat as quarantined until reconciled")
+		rep.Responsibility = Responsibility{
+			State: StateUnknown, Role: RoleNone,
+			WaitReason: "recovery hold state could not be read",
+		}
+		rep.NextStep = NextStep{Action: ActionNone, Reason: "cannot prove the run is free of an open recovery hold"}
+	case openHold(ev):
+		hold := ev.Hold
+		rep.Responsibility = Responsibility{
+			State: StateRecoveryHold, Role: RoleOperationOwner,
+			WaitReason: holdReason(hold), Since: hold.CreatedAt,
+		}
+		rep.NextStep = NextStep{Action: ActionReleaseRecoveryHold, Reason: holdReason(hold)}
+	case needsReconcile(ev):
+		reason := "recovery hold released but the run is still interrupted"
+		since := ""
+		if ev.Hold != nil {
+			since = ev.Hold.ReleasedAt
+			if ev.Hold.Reason != "" {
+				reason += "; hold reason: " + ev.Hold.Reason
+			}
+		}
+		rep.Responsibility = Responsibility{State: StateReconciling, Role: RoleOperationOwner, WaitReason: reason, Since: since}
+		rep.NextStep = NextStep{Action: ActionNeedsManualReconciliation, Reason: reason}
+	case ev.Run.Status == core.RunWaitingHITL || card != nil || decision != nil:
+		reason := "waiting for a human decision"
+		since := ""
+		if decision != nil {
+			reason = decision.Question
+			if reason == "" {
+				reason = "pending human decision on command " + decision.CommandID
+			}
+			since = decision.IssuedAt.UTC().Format(time.RFC3339)
+		} else if card != nil {
+			reason = card.Question
+			if reason == "" {
+				reason = "run is waiting on a HITL card"
+			}
+			since = card.CreatedAt
+		}
+		rep.Responsibility = Responsibility{State: StateWaitingHITL, Role: RoleHuman, WaitReason: reason, Since: since}
+		if card == nil && decision == nil {
+			// 只由 run 状态驱动：没有可解析的卡，也不知道等待从何时开始。
+			rep.Notes = append(rep.Notes, "run is marked waiting_hitl with no open card recorded; the wait entry time is not stored")
+		}
+		rep.NextStep = NextStep{Action: ActionConfirmCard, CardID: hitlCardID(card, decision), Reason: reason}
+	case confirm != nil:
+		reason := "dangerous command " + confirm.command + " awaits explicit confirmation"
+		rep.Responsibility = Responsibility{
+			State: StateConfirmationPending, Role: RoleHuman,
+			WaitReason: reason, Since: confirm.row.CreatedAt,
+		}
+		rep.NextStep = NextStep{Action: ActionConfirmCard, CardID: confirm.row.CardID, Reason: reason}
+	case ev.Run.Status == core.RunFailed:
+		reason := "run failed"
+		if ev.Run.Error != nil {
+			reason = fmt.Sprintf("run failed: %s: %s", ev.Run.Error.Code, ev.Run.Error.Message)
+		}
+		rep.Responsibility = Responsibility{State: StateFailed, Role: RoleRunner, WaitReason: reason, Since: endedAt(ev.Run)}
+		// 重试安全性看已记录的副作用证据：没有 open hold 且没有 unknown 回执时，
+		// 重试不会复制本次运行的后果；否则先对账再重试，不说"安全"。
+		if unknown := unknownOperations(rep.SideEffects); unknown > 0 {
+			reason := fmt.Sprintf("terminal failure, but %d recorded operation(s) have an unknown outcome; reconcile side effects before retrying", unknown)
+			rep.Notes = append(rep.Notes, reason)
+			rep.NextStep = NextStep{Action: ActionNeedsManualReconciliation, Reason: reason}
+		} else {
+			rep.NextStep = NextStep{Action: ActionSafeRetry, Reason: "terminal failure with no open recovery hold and no unknown receipt; retry is safe to attempt"}
+		}
+	case ev.Run.Status == core.RunCompleted:
+		rep.Responsibility = Responsibility{State: StateCompleted, Role: RoleNone, WaitReason: "run completed", Since: endedAt(ev.Run)}
+		rep.NextStep = NextStep{Action: ActionNone, Reason: "run already completed"}
+	case ev.Run.Status == core.RunRunning || ev.Run.Status == core.RunPending:
+		rep.Responsibility = Responsibility{
+			State: StateRunning, Role: RoleRunner,
+			WaitReason: "run is executing", Since: ev.Run.CreatedAt.UTC().Format(time.RFC3339),
+		}
+		rep.NextStep = NextStep{Action: ActionNone, Reason: "runner is executing; no operator action"}
+	default:
+		reason := fmt.Sprintf("run status %q has no diagnostic mapping", ev.Run.Status)
+		rep.Notes = append(rep.Notes, reason)
+		rep.Responsibility = Responsibility{State: StateUnknown, Role: RoleNone, WaitReason: reason, Since: endedAt(ev.Run)}
+		rep.NextStep = NextStep{Action: ActionNone, Reason: "status is unmapped; inspect the run record manually"}
+	}
+
+	if ev.Checkpoint == nil {
+		rep.Notes = append(rep.Notes, "no persisted checkpoint reference for this run (no durable stream event)")
+	}
+	if len(rep.SideEffects) == 0 {
+		rep.Notes = append(rep.Notes, "no recorded side effect evidence; absence of records is not proof of no effect")
+	}
+	return rep
+}
+
+func runSummary(ev Evidence) RunSummary {
+	summary := RunSummary{
+		ID: string(ev.Run.ID), Status: string(ev.Run.Status), Kind: string(ev.Run.Kind),
+		Phase: string(ev.Run.Phase), Owner: string(ev.Run.Owner), Project: string(ev.Run.ProjectID),
+		Conversation: string(ev.Run.ConversationID),
+	}
+	if !ev.Run.CreatedAt.IsZero() {
+		summary.CreatedAt = ev.Run.CreatedAt.UTC().Format(time.RFC3339)
+	}
+	// updated：终态取 ended_at，未终态取最后一次落盘（检查点）的时间。
+	if ended := endedAt(ev.Run); ended != "" {
+		summary.UpdatedAt = &ended
+	} else if ev.Checkpoint != nil && ev.Checkpoint.TS != "" {
+		ts := ev.Checkpoint.TS
+		summary.UpdatedAt = &ts
+	}
+	return summary
+}
+
+// sideEffects 汇总已记录的外部副作用证据：命令回执对账记录（U7b 审计信封）加上
+// 恢复隔离行（U3b 的"结果未知"证据）。
+func sideEffects(ev Evidence) []SideEffect {
+	out := []SideEffect{}
+	if ev.Hold != nil {
+		state := "held"
+		if ev.Hold.ReleasedAt != "" {
+			state = "released"
+		}
+		out = append(out, SideEffect{
+			Kind: EffectRecoveryHold, State: state, At: ev.Hold.CreatedAt, ReleasedAt: ev.Hold.ReleasedAt,
+		})
+	}
+	for _, env := range ev.Audits {
+		if !belongsToRun(ev, env) {
+			continue
+		}
+		out = append(out, SideEffect{
+			Kind: EffectOperation, OperationID: env.OperationID, CommandID: env.CommandID,
+			State: string(env.State), At: env.Time.UTC().Format(time.RFC3339),
+		})
+		if len(out) >= maxSideEffects {
+			break
+		}
+	}
+	return out
+}
+
+// belongsToRun 是审计信封的归属边界：信封自带 runId 时以它为准；否则只在"同一
+// owner + 会话且签发时间不早于 run 创建时间"的窗口内归属——会话里更早的记录属于
+// 更早的 run，不算进本次副作用。
+func belongsToRun(ev Evidence, env agentcommand.AuditEnvelope) bool {
+	if env.RunID != "" {
+		return env.RunID == string(ev.Run.ID)
+	}
+	if string(env.ConversationID) != "" && string(env.ConversationID) != string(ev.Run.ConversationID) {
+		return false
+	}
+	if !ev.Run.CreatedAt.IsZero() && !env.Time.IsZero() && env.Time.Before(ev.Run.CreatedAt) {
+		return false
+	}
+	return true
+}
+
+func openHold(ev Evidence) bool {
+	return ev.Hold != nil && ev.Hold.ReleasedAt == ""
+}
+
+// unknownOperations 统计结果未知的已记录 operation（四态语义里的 unknown：
+// 执行过但结果不确定）。它是"重试会不会复制副作用"的直接证据。
+func unknownOperations(effects []SideEffect) int {
+	n := 0
+	for _, e := range effects {
+		if e.Kind == EffectOperation && e.State == string(agentcommand.StateUnknown) {
+			n++
+		}
+	}
+	return n
+}
+
+// needsReconcile 是 U3b 隔离解除后的残留态：隔离已解除，但 run 仍停在中断态——
+// 没有人把它推进到终态，需要人工对账。
+func needsReconcile(ev Evidence) bool {
+	return ev.Hold != nil && ev.Hold.ReleasedAt != "" && ev.Run.Status == core.RunInterrupted
+}
+
+func holdReason(hold *store.RecoveryHold) string {
+	if hold == nil || hold.Reason == "" {
+		return "external side effect outcome unknown (recovery hold)"
+	}
+	return hold.Reason
+}
+
+func endedAt(run core.Run) string {
+	if run.EndedAt == nil {
+		return ""
+	}
+	return run.EndedAt.UTC().Format(time.RFC3339)
+}
+
+// waitingCard 取该 run 未关闭的 HITL 卡（最早一张；只看未关闭的）。
+func waitingCard(ev Evidence) *core.HITLCard {
+	for i := range ev.Cards {
+		if ev.Cards[i].Resolved || ev.Cards[i].Blocked {
+			continue
+		}
+		return &ev.Cards[i]
+	}
+	return nil
+}
+
+// waitingDecision 取本 run 生命周期内签发、仍未过期的人工决策卡。
+func waitingDecision(ev Evidence) *store.HumanDecision {
+	for i := range ev.Decisions {
+		rec := &ev.Decisions[i]
+		if rec.Status != "pending" {
+			continue
+		}
+		if !rec.IssuedAt.IsZero() && !ev.Run.CreatedAt.IsZero() && rec.IssuedAt.Before(ev.Run.CreatedAt) {
+			continue // 签发在本次 run 之前：属于更早的等待，不算本次
+		}
+		return rec
+	}
+	return nil
+}
+
+type scopedConfirm struct {
+	row     store.PendingConfirm
+	command string
+}
+
+// waitingConfirm 取本 run 生命周期内、同一会话挂起的危险命令确认行。载荷是总线
+// 落下的分发请求；解析不出会话的旧行按"无记录"处理，不回显原始载荷。
+func waitingConfirm(ev Evidence) *scopedConfirm {
+	for _, row := range ev.Confirms {
+		req := cmdbus.Request{}
+		if err := json.Unmarshal([]byte(row.Payload), &req); err != nil {
+			continue
+		}
+		if req.ConversationID != "" && req.ConversationID != string(ev.Run.ConversationID) {
+			continue
+		}
+		if req.Owner != "" && string(ev.Run.Owner) != "" && req.Owner != string(ev.Run.Owner) {
+			continue
+		}
+		created, err := time.Parse(time.RFC3339, row.CreatedAt)
+		if err == nil && !ev.Run.CreatedAt.IsZero() && created.Before(ev.Run.CreatedAt) {
+			continue // 挂起早于本次 run：属于更早的等待
+		}
+		return &scopedConfirm{row: row, command: req.ID}
+	}
+	return nil
+}
+
+// hitlCardID 给出可解析的卡标识：HITL 卡优先，其次决策卡 ID。
+func hitlCardID(card *core.HITLCard, decision *store.HumanDecision) string {
+	if card != nil {
+		return string(card.ID)
+	}
+	if decision != nil {
+		return decision.ID
+	}
+	return ""
+}
+
+func (ev Evidence) withNote(note string) Evidence {
+	ev.Notes = append(ev.Notes, note)
+	return ev
+}

internal/rundiag/rundiag_test.go

@@ -0,0 +1,440 @@
+package rundiag
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+var (
+	baseTime = time.Date(2026, 10, 20, 10, 0, 0, 0, time.UTC)
+	afterRun = baseTime.Add(5 * time.Minute)
+)
+
+// fakeSource 是只读端口的合成替身：每个字段都能单独触发"没有记录"或"读取失败"。
+type fakeSource struct {
+	hold      store.RecoveryHold
+	holdErr   error
+	cards     []core.HITLCard
+	decisions []store.HumanDecision
+	confirms  []store.PendingConfirm
+	cp        store.RunCheckpoint
+	cpOK      bool
+	audits    []agentcommand.AuditEnvelope
+}
+
+func (f fakeSource) GetRecoveryHold(string) (store.RecoveryHold, error) {
+	if f.holdErr != nil {
+		return store.RecoveryHold{}, f.holdErr
+	}
+	if f.hold.RunID == "" {
+		return store.RecoveryHold{}, store.ErrNotFound
+	}
+	return f.hold, nil
+}
+
+func (f fakeSource) ActiveHITLCardsByRun(string) ([]core.HITLCard, error) { return f.cards, nil }
+
+func (f fakeSource) PendingHumanDecisionsByConversation(string, string, time.Time) ([]store.HumanDecision, error) {
+	return f.decisions, nil
+}
+
+func (f fakeSource) ListOwnerPendingConfirms(string, int) ([]store.PendingConfirm, error) {
+	return f.confirms, nil
+}
+
+func (f fakeSource) LastRunCheckpoint(string, string) (store.RunCheckpoint, bool, error) {
+	return f.cp, f.cpOK, nil
+}
+
+func (f fakeSource) ListAudits(string, string, int) ([]agentcommand.AuditEnvelope, error) {
+	return f.audits, nil
+}
+
+func run(status core.RunStatus) core.Run {
+	return core.Run{
+		ID: "run_1", ConversationID: "cnv_1", ProjectID: "prj_1", Owner: "alice",
+		Kind: core.RunConversation, Status: status, Phase: core.PhaseResponding, CreatedAt: baseTime,
+	}
+}
+
+func ended(r core.Run, at time.Time) core.Run {
+	r.EndedAt = &at
+	return r
+}
+
+func checkpoint() *store.RunCheckpoint {
+	return &store.RunCheckpoint{Seq: 7, TS: baseTime.Add(2 * time.Minute).Format(time.RFC3339), Type: "agent.progress"}
+}
+
+// A2 契约：每个 responsibility.state 都有驱动它的记录，且 next_step 逐状态映射正确。
+func TestBuildResponsibilityStatesAndNextStep(t *testing.T) {
+	cases := []struct {
+		name     string
+		ev       Evidence
+		state    string
+		role     string
+		action   string
+		cardID   string
+		waitHint string
+		since    string
+	}{
+		{
+			name: "unreleased recovery hold wins over everything",
+			ev: Evidence{
+				Run: run(core.RunRunning),
+				Hold: &store.RecoveryHold{RunID: "run_1", Owner: "alice", Reason: "unknown external effect",
+					CreatedAt: afterRun.Format(time.RFC3339)},
+				Cards: []core.HITLCard{{ID: "card_hitl", Resolved: false, Question: "approve?"}},
+			},
+			state: StateRecoveryHold, role: RoleOperationOwner, action: ActionReleaseRecoveryHold,
+			waitHint: "unknown external effect", since: afterRun.Format(time.RFC3339),
+		},
+		{
+			name: "released hold on an interrupted run needs reconciliation",
+			ev: Evidence{
+				Run: run(core.RunInterrupted),
+				Hold: &store.RecoveryHold{RunID: "run_1", Owner: "alice", Reason: "unknown external effect",
+					CreatedAt: afterRun.Format(time.RFC3339), ReleasedAt: afterRun.Add(time.Minute).Format(time.RFC3339)},
+			},
+			state: StateReconciling, role: RoleOperationOwner, action: ActionNeedsManualReconciliation,
+			waitHint: "still interrupted", since: afterRun.Add(time.Minute).Format(time.RFC3339),
+		},
+		{
+			name: "waiting on a HITL card",
+			ev: Evidence{
+				Run:   run(core.RunWaitingHITL),
+				Cards: []core.HITLCard{{ID: "card_hitl", CreatedAt: afterRun.Format(time.RFC3339), Question: "approve the plan?"}},
+			},
+			state: StateWaitingHITL, role: RoleHuman, action: ActionConfirmCard, cardID: "card_hitl",
+			waitHint: "approve the plan?", since: afterRun.Format(time.RFC3339),
+		},
+		{
+			name: "waiting on a pending human decision without a run card",
+			ev: Evidence{
+				Run: run(core.RunRunning),
+				Decisions: []store.HumanDecision{{ID: "hd_1", CommandID: "rdm.confirm", Status: "pending",
+					Question: "approve delivery?", IssuedAt: afterRun, ExpiresAt: afterRun.Add(time.Hour)}},
+			},
+			state: StateWaitingHITL, role: RoleHuman, action: ActionConfirmCard, cardID: "hd_1",
+			waitHint: "approve delivery?", since: afterRun.Format(time.RFC3339),
+		},
+		{
+			name: "dangerous command awaiting confirmation",
+			ev: Evidence{
+				Run: run(core.RunRunning),
+				Confirms: []store.PendingConfirm{{CardID: "card_cmd", Owner: "alice", CreatedAt: afterRun.Format(time.RFC3339),
+					Payload: mustRequest(t, cmdbus.Request{ID: "rdm.docs.instantiate", Owner: "alice", ConversationID: "cnv_1"})}},
+			},
+			state: StateConfirmationPending, role: RoleHuman, action: ActionConfirmCard, cardID: "card_cmd",
+			waitHint: "rdm.docs.instantiate", since: afterRun.Format(time.RFC3339),
+		},
+		{
+			name: "terminal failure is a safe retry",
+			ev: Evidence{
+				Run: ended(func() core.Run {
+					r := run(core.RunFailed)
+					r.Error = &core.ErrorPart{Code: "run.tool_failed", Message: "tool crashed"}
+					return r
+				}(), afterRun),
+			},
+			state: StateFailed, role: RoleRunner, action: ActionSafeRetry,
+			waitHint: "run.tool_failed: tool crashed", since: afterRun.Format(time.RFC3339),
+		},
+		{
+			name: "terminal failure with an unknown receipt needs reconciliation, not a retry",
+			ev: Evidence{
+				Run: ended(run(core.RunFailed), afterRun),
+				Audits: []agentcommand.AuditEnvelope{{Time: afterRun, CommandID: "rdm.docs.instantiate",
+					OperationID: "op_unknown", State: agentcommand.StateUnknown, ConversationID: "cnv_1"}},
+			},
+			state: StateFailed, role: RoleRunner, action: ActionNeedsManualReconciliation,
+			waitHint: "run failed",
+		},
+		{
+			name:  "completed needs no action",
+			ev:    Evidence{Run: ended(run(core.RunCompleted), afterRun)},
+			state: StateCompleted, role: RoleNone, action: ActionNone,
+			waitHint: "completed", since: afterRun.Format(time.RFC3339),
+		},
+		{
+			name:  "executing run stays with the runner",
+			ev:    Evidence{Run: run(core.RunRunning)},
+			state: StateRunning, role: RoleRunner, action: ActionNone,
+			waitHint: "executing", since: baseTime.Format(time.RFC3339),
+		},
+		{
+			name:  "pending run reads as running",
+			ev:    Evidence{Run: run(core.RunPending)},
+			state: StateRunning, role: RoleRunner, action: ActionNone,
+			waitHint: "executing",
+		},
+		{
+			name:  "cancelled has no mapping and degrades to unknown",
+			ev:    Evidence{Run: ended(run(core.RunCancelled), afterRun)},
+			state: StateUnknown, role: RoleNone, action: ActionNone,
+			waitHint: "no diagnostic mapping",
+		},
+		{
+			name:  "interrupted without any hold record degrades to unknown",
+			ev:    Evidence{Run: run(core.RunInterrupted)},
+			state: StateUnknown, role: RoleNone, action: ActionNone,
+			waitHint: "no diagnostic mapping",
+		},
+		{
+			name:  "unreadable hold is fail-closed unknown, never a safe retry",
+			ev:    Evidence{Run: run(core.RunFailed), HoldUnknown: true},
+			state: StateUnknown, role: RoleNone, action: ActionNone,
+			waitHint: "could not be read",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rep := Build(tc.ev)
+			if rep.Responsibility.State != tc.state {
+				t.Fatalf("state=%q want %q (responsibility=%+v)", rep.Responsibility.State, tc.state, rep.Responsibility)
+			}
+			if rep.Responsibility.Role != tc.role {
+				t.Fatalf("role=%q want %q", rep.Responsibility.Role, tc.role)
+			}
+			if rep.NextStep.Action != tc.action {
+				t.Fatalf("next_step=%q want %q (reason=%q)", rep.NextStep.Action, tc.action, rep.NextStep.Reason)
+			}
+			if rep.NextStep.CardID != tc.cardID {
+				t.Fatalf("next_step.card_id=%q want %q", rep.NextStep.CardID, tc.cardID)
+			}
+			if tc.waitHint != "" && !strings.Contains(rep.Responsibility.WaitReason, tc.waitHint) {
+				t.Fatalf("wait_reason=%q does not contain %q", rep.Responsibility.WaitReason, tc.waitHint)
+			}
+			if tc.since != "" && rep.Responsibility.Since != tc.since {
+				t.Fatalf("since=%q want %q", rep.Responsibility.Since, tc.since)
+			}
+			if rep.NextStep.Reason == "" {
+				t.Fatal("next_step.reason must never be empty")
+			}
+		})
+	}
+}
+
+// 副作用聚合：命令回执对账记录并入；会话里更早的记录不算本次 run 的副作用。
+func TestBuildSideEffectsAggregateRecordedOperations(t *testing.T) {
+	ev := Evidence{
+		Run: run(core.RunFailed),
+		Audits: []agentcommand.AuditEnvelope{
+			{Time: baseTime.Add(-time.Hour), CommandID: "rdm.reqs.add", OperationID: "op_older",
+				State: agentcommand.StateCommitted, ConversationID: "cnv_1"},
+			{Time: afterRun, CommandID: "rdm.docs.instantiate", OperationID: "op_1",
+				State: agentcommand.StateUnknown, ConversationID: "cnv_1"},
+			{Time: afterRun, CommandID: "other.run.command", OperationID: "op_2",
+				State: agentcommand.StateCommitted, ConversationID: "cnv_other"},
+			{Time: afterRun, CommandID: "rdm.trace.confirm", OperationID: "op_3",
+				State: agentcommand.StateAccepted, ConversationID: "cnv_1", RunID: "run_1"},
+		},
+	}
+	rep := Build(ev)
+	if len(rep.SideEffects) != 2 {
+		t.Fatalf("side effects must hold only this run's receipts: %+v", rep.SideEffects)
+	}
+	got := map[string]SideEffect{}
+	for _, se := range rep.SideEffects {
+		got[se.OperationID] = se
+	}
+	recorded, ok := got["op_1"]
+	if !ok || recorded.Kind != EffectOperation || recorded.CommandID != "rdm.docs.instantiate" || recorded.State != string(agentcommand.StateUnknown) {
+		t.Fatalf("recorded operation missing from aggregation: %+v", rep.SideEffects)
+	}
+	if _, ok := got["op_older"]; ok {
+		t.Fatal("a receipt issued before the run started must not be attributed to it")
+	}
+	if _, ok := got["op_2"]; ok {
+		t.Fatal("a receipt from another conversation must not be attributed to this run")
+	}
+	if _, ok := got["op_3"]; !ok {
+		t.Fatal("a receipt carrying this run id must be attributed to it")
+	}
+}
+
+// hold 行本身也是"副作用结果未知"的持久证据（U3b），并标出是否已解除。
+func TestBuildSideEffectsIncludeRecoveryHoldEvidence(t *testing.T) {
+	ev := Evidence{Run: run(core.RunInterrupted), Hold: &store.RecoveryHold{RunID: "run_1", Owner: "alice",
+		Reason: "unknown", CreatedAt: afterRun.Format(time.RFC3339)}}
+	rep := Build(ev)
+	if len(rep.SideEffects) != 1 || rep.SideEffects[0].Kind != EffectRecoveryHold || rep.SideEffects[0].State != "held" {
+		t.Fatalf("open hold must show as held evidence: %+v", rep.SideEffects)
+	}
+	ev.Hold.ReleasedAt = afterRun.Add(time.Minute).Format(time.RFC3339)
+	rep = Build(ev)
+	if rep.SideEffects[0].State != "released" || rep.SideEffects[0].ReleasedAt == "" {
+		t.Fatalf("released hold must keep its release time: %+v", rep.SideEffects[0])
+	}
+}
+
+// 没有落盘检查点时给 null + note，绝不编一个；空副作用同样带 note。
+func TestBuildNeverFabricatesCheckpointOrAbsence(t *testing.T) {
+	rep := Build(Evidence{Run: run(core.RunRunning)})
+	if rep.LastCheckpoint != nil {
+		t.Fatalf("checkpoint must stay null when nothing is persisted: %+v", rep.LastCheckpoint)
+	}
+	if !containsNote(rep.Notes, "checkpoint") {
+		t.Fatalf("missing checkpoint note: %v", rep.Notes)
+	}
+	if !containsNote(rep.Notes, "absence of records is not proof") {
+		t.Fatalf("missing side effect absence note: %v", rep.Notes)
+	}
+	if rep.SideEffects == nil {
+		t.Fatal("side_effects must serialize as an array, never null")
+	}
+	withCheckpoint := Build(Evidence{Run: run(core.RunRunning), Checkpoint: checkpoint()})
+	if withCheckpoint.LastCheckpoint == nil || withCheckpoint.LastCheckpoint.ID != "7" || withCheckpoint.Run.UpdatedAt == nil {
+		t.Fatalf("persisted checkpoint must be surfaced: %+v", withCheckpoint)
+	}
+	if *withCheckpoint.Run.UpdatedAt != checkpoint().TS {
+		t.Fatalf("updated_at must fall back to the last persisted event: %v", *withCheckpoint.Run.UpdatedAt)
+	}
+}
+
+// Gather：只读端口的读齐与降级（读不到隔离记录按 fail-closed）。
+func TestGatherReadsEvidenceAndDegradesOnError(t *testing.T) {
+	src := fakeSource{
+		hold:     store.RecoveryHold{RunID: "run_1", Owner: "alice", Reason: "unknown", CreatedAt: afterRun.Format(time.RFC3339)},
+		cards:    []core.HITLCard{{ID: "card_hitl"}},
+		cp:       store.RunCheckpoint{Seq: 3, TS: afterRun.Format(time.RFC3339), Type: "agent.progress"},
+		cpOK:     true,
+		audits:   []agentcommand.AuditEnvelope{{Time: afterRun, CommandID: "rdm.confirm", State: agentcommand.StateAccepted}},
+		confirms: []store.PendingConfirm{{CardID: "card_cmd", Owner: "alice", CreatedAt: afterRun.Format(time.RFC3339), Payload: "{}"}},
+	}
+	ev := Gather(src, run(core.RunRunning), afterRun.Add(time.Minute))
+	if ev.Hold == nil || ev.HoldUnknown || len(ev.Cards) != 1 || ev.Checkpoint == nil || len(ev.Audits) != 1 || len(ev.Confirms) != 1 {
+		t.Fatalf("gather missed evidence: %+v", ev)
+	}
+	if rep := Build(ev); rep.Responsibility.State != StateRecoveryHold {
+		t.Fatalf("state=%q want %q", rep.Responsibility.State, StateRecoveryHold)
+	}
+
+	degraded := Gather(fakeSource{holdErr: errors.New("db gone")}, run(core.RunRunning), afterRun)
+	if !degraded.HoldUnknown || degraded.Hold != nil {
+		t.Fatalf("an unreadable hold must stay unknown, never absent: %+v", degraded)
+	}
+	rep := Build(degraded)
+	if rep.Responsibility.State != StateUnknown || rep.NextStep.Action == ActionSafeRetry {
+		t.Fatalf("unreadable hold must not yield a retry: %+v", rep)
+	}
+	if !containsNote(rep.Notes, "fail-closed") && !containsNote(rep.Notes, "quarantined") {
+		t.Fatalf("missing fail-closed note: %v", rep.Notes)
+	}
+
+	// 没有隔离行是正常态：不产生噪音 note。
+	normal := Build(Gather(fakeSource{}, run(core.RunRunning), afterRun))
+	if containsNote(normal.Notes, "recovery hold unreadable") {
+		t.Fatalf("a missing hold row is not a degraded read: %v", normal.Notes)
+	}
+}
+
+// 契约形状：snake_case 字段名固定，last_checkpoint 为 null 时显式出现。
+func TestReportJSONContract(t *testing.T) {
+	raw, err := json.Marshal(Build(Evidence{Run: run(core.RunRunning), Checkpoint: checkpoint()}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out map[string]any
+	if err := json.Unmarshal(raw, &out); err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range []string{"run", "responsibility", "last_checkpoint", "side_effects", "next_step"} {
+		if _, ok := out[key]; !ok {
+			t.Fatalf("missing contract key %q in %s", key, raw)
+		}
+	}
+	responsibility, _ := out["responsibility"].(map[string]any)
+	for _, key := range []string{"state", "role", "wait_reason", "since"} {
+		if _, ok := responsibility[key]; !ok {
+			t.Fatalf("missing responsibility key %q in %s", key, raw)
+		}
+	}
+	runSummary, _ := out["run"].(map[string]any)
+	for _, key := range []string{"id", "status", "owner", "project", "conversation", "created_at", "updated_at"} {
+		if _, ok := runSummary[key]; !ok {
+			t.Fatalf("missing run key %q in %s", key, raw)
+		}
+	}
+	nextStep, _ := out["next_step"].(map[string]any)
+	for _, key := range []string{"action", "reason"} {
+		if _, ok := nextStep[key]; !ok {
+			t.Fatalf("missing next_step key %q in %s", key, raw)
+		}
+	}
+
+	empty, err := json.Marshal(Build(Evidence{Run: run(core.RunRunning)}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var nulled map[string]any
+	if err := json.Unmarshal(empty, &nulled); err != nil {
+		t.Fatal(err)
+	}
+	if nulled["last_checkpoint"] != nil {
+		t.Fatalf("last_checkpoint must be null (not omitted) when nothing is persisted: %s", empty)
+	}
+	if _, ok := nulled["side_effects"].([]any); !ok {
+		t.Fatalf("side_effects must be an array: %s", empty)
+	}
+}
+
+// 归属边界：会话里更早签发的决策卡与确认行不算本次 run 在等的东西。
+func TestBuildIgnoresEvidenceIssuedBeforeTheRun(t *testing.T) {
+	ev := Evidence{
+		Run: run(core.RunRunning),
+		Decisions: []store.HumanDecision{{ID: "hd_old", Status: "pending", Question: "older?",
+			IssuedAt: baseTime.Add(-time.Hour), ExpiresAt: baseTime.Add(time.Hour)}},
+		Confirms: []store.PendingConfirm{{CardID: "card_old", Owner: "alice",
+			CreatedAt: baseTime.Add(-time.Hour).Format(time.RFC3339),
+			Payload:   mustRequest(t, cmdbus.Request{ID: "rdm.confirm", Owner: "alice", ConversationID: "cnv_1"})}},
+	}
+	rep := Build(ev)
+	if rep.Responsibility.State != StateRunning {
+		t.Fatalf("state=%q want %q: earlier conversation evidence must not hold this run", rep.Responsibility.State, StateRunning)
+	}
+}
+
+// 只有 run 状态写着 waiting_hitl、没有可解析的卡时：状态仍然成立，但必须说清楚
+// 等待起点没被存储。
+func TestBuildStatusDrivenWaitHasNoCardAndSaysSo(t *testing.T) {
+	rep := Build(Evidence{Run: run(core.RunWaitingHITL)})
+	if rep.Responsibility.State != StateWaitingHITL || rep.NextStep.Action != ActionConfirmCard {
+		t.Fatalf("status-driven wait: %+v", rep.Responsibility)
+	}
+	if rep.NextStep.CardID != "" {
+		t.Fatalf("an unresolvable card must not be invented: %q", rep.NextStep.CardID)
+	}
+	if rep.Responsibility.Since != "" {
+		t.Fatalf("unknown wait entry time must stay empty: %q", rep.Responsibility.Since)
+	}
+	if !containsNote(rep.Notes, "wait entry time is not stored") {
+		t.Fatalf("missing status-driven wait note: %v", rep.Notes)
+	}
+}
+
+func mustRequest(t *testing.T, req cmdbus.Request) string {
+	t.Helper()
+	raw, err := json.Marshal(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(raw)
+}
+
+func containsNote(notes []string, want string) bool {
+	for _, n := range notes {
+		if strings.Contains(n, want) {
+			return true
+		}
+	}
+	return false
+}

internal/runmgr/memory.go

@@ -2,6 +2,7 @@ package runmgr
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	"agent-native/runtime/memory"
@@ -17,23 +18,38 @@ type storeMemory struct {
 	projectID            string
 	checked              bool
 	allowImplicitDefault bool
+	// scratch 为真时端口对 user/project 记忆完全关闭：临时会话不读也不写
+	// 跨会话记忆（U2 隔离）。会话内状态不受影响。
+	scratch bool
 }
 
+// ErrScratchMemory 临时会话不写记忆：记忆是跨会话的共享层。
+var ErrScratchMemory = errors.New("memory is not available in scratch sessions")
+
 // NewStoreMemory 构建端口实现（owner 为空时用默认租户）。
 func NewStoreMemory(st *store.Store, owner, projectID string) memory.Store {
+	return newStoreMemory(st, owner, projectID, false)
+}
+
+func newStoreMemory(st *store.Store, owner, projectID string, checked bool) *storeMemory {
 	if owner == "" {
 		owner = store.OwnerDefault
 	}
-	return &storeMemory{st: st, owner: owner, projectID: projectID}
+	return &storeMemory{st: st, owner: owner, projectID: projectID, checked: checked}
 }
 
-func newAccountCheckedStoreMemory(st *store.Store, owner, projectID string, allowImplicitDefault bool) memory.Store {
-	return &storeMemory{st: st, owner: owner, projectID: projectID, checked: true, allowImplicitDefault: allowImplicitDefault}
+func newAccountCheckedStoreMemory(st *store.Store, owner, projectID string, allowImplicitDefault bool) *storeMemory {
+	port := newStoreMemory(st, owner, projectID, true)
+	port.allowImplicitDefault = allowImplicitDefault
+	return port
 }
 
 // Recall 按 scope 过滤（空 = 不限，保持迁移前 Memories() 的全量语义），
 // 过期与空内容条目的剔除与文案渲染在 memory.Block（同一形态）。
 func (m *storeMemory) Recall(ctx context.Context, q memory.RecallQuery) ([]memory.Entry, error) {
+	if m.scratch {
+		return nil, nil
+	}
 	projectID := ""
 	if q.Scope == "project" {
 		projectID = m.projectID
@@ -65,14 +81,21 @@ func (c *runCtx) StoreMemory() memory.Store {
 	if c.mgr == nil || c.mgr.st == nil {
 		return nil
 	}
+	var port *storeMemory
 	if c.mgr.accountEffectiveAuthorization != nil {
-		return newAccountCheckedStoreMemory(c.mgr.st, c.run.Owner, c.run.ProjectID, c.mgr.accountAllowImplicitLocal)
+		port = newAccountCheckedStoreMemory(c.mgr.st, c.run.Owner, c.run.ProjectID, c.mgr.accountAllowImplicitLocal)
+	} else {
+		port = newStoreMemory(c.mgr.st, c.run.Owner, c.run.ProjectID, false)
 	}
-	return NewStoreMemory(c.mgr.st, c.run.Owner, c.run.ProjectID)
+	port.scratch = c.scratchProject()
+	return port
 }
 
 // Append 写回一条（project scope 用适配器的项目上下文）。
 func (m *storeMemory) Append(ctx context.Context, e memory.Entry) error {
+	if m.scratch {
+		return ErrScratchMemory
+	}
 	projectID := e.ProjectID
 	if e.Scope == "project" && projectID == "" {
 		projectID = m.projectID

internal/runmgr/project_context.go

@@ -31,8 +31,11 @@ func (m *Manager) SetProjectContextSourceRechecker(fn func(context.Context, exte
 	m.projectSourceRechecker = fn
 }
 
+// ProjectContextEnabled 报告本回合是否组装项目上下文。临时会话没有 RDM 项目
+// 上下文（它就是一个通用代理会话），所以即使 provider 已注册也不启用；基座项目
+// 读不到时按普通项目处理，门禁照旧收紧。
 func (c *runCtx) ProjectContextEnabled() bool {
-	return c.run.ProjectID != "" && c.mgr.projectContextResolver != nil
+	return c.run.ProjectID != "" && c.mgr.projectContextResolver != nil && !c.confirmedScratchProject()
 }
 
 // ValidateProjectCrossGuard links separate model streams in one persisted run.
@@ -282,7 +285,10 @@ func (c *runCtx) ProjectEvidence(ctx context.Context, id string) (extension.Proj
 // ProjectContext reloads identity and project from trusted run and conversation
 // rows on every model request, including a resumed or background run.
 func (c *runCtx) ProjectContext(ctx context.Context, goal string, budget int) (extension.ProjectContextBundle, bool, error) {
-	if c.run.ProjectID == "" || c.mgr.projectContextResolver == nil {
+	// ProjectContextEnabled 已经是本回合唯一的项目上下文开关（含临时会话）：不在
+	// 这里再调 resolver，否则 llm.go 的 refresh.ProjectContext、GuardProjectStream
+	// 与其它任何调用方都会替临时会话把项目上下文取回来。
+	if c.run.ProjectID == "" || c.mgr.projectContextResolver == nil || !c.ProjectContextEnabled() {
 		return extension.ProjectContextBundle{}, false, nil
 	}
 	req, err := c.trustedProjectContextRequest(ctx, budget)

internal/runmgr/runmgr.go

@@ -344,7 +344,7 @@ func (m *Manager) SetProjectWorkGate(preflight projectWorkPreflight, respond pro
 }
 
 func (c *runCtx) requireProjectWorkDecision(action string) error {
-	if !c.mgr.projectWorkObservationEnabled || c.run.ProjectID == "" {
+	if !c.projectWorkObservationApplies() {
 		return nil
 	}
 	for {
@@ -408,7 +408,71 @@ func (m *Manager) cancelActiveOwnerRuns(owner string) {
 		cancel()
 	}
 }
+
+// scratchHostFlag 按存储里的 host 标记判定本次 run 的基座项目是否为临时会话。
+// ok=false 表示这次没判定成功（读不到项目），此时不缓存答案——run 生命周期内项目
+// 不变，下次读得到时再判定。两个方向的 fail closed 由调用点各取所需。
+func (c *runCtx) scratchHostFlag() (host bool, ok bool) {
+	if c == nil || c.mgr == nil || c.mgr.st == nil || c.run.ProjectID == "" {
+		return false, false
+	}
+	c.scratchMu.Lock()
+	host, known := c.scratchHost, c.scratchKnown
+	c.scratchMu.Unlock()
+	if known {
+		return host, true
+	}
+	host, err := c.mgr.st.IsScratchProjectID(string(c.run.ProjectID))
+	if err != nil {
+		return false, false
+	}
+	c.scratchMu.Lock()
+	c.scratchHost, c.scratchKnown = host, true
+	c.scratchMu.Unlock()
+	return host, true
+}
+
+// scratchProject 报告本次 run 的基座项目是否是临时会话，供隔离门禁使用（记忆、
+// 上下文条目、检索、跨会话读取、记忆端口）。读不到项目时 fail closed：本次调用按
+// 临时会话处理且不缓存这个未知答案——这些门禁只收紧，读不到宿主就不能为整个 run
+// 把它们全部放开。
+func (c *runCtx) scratchProject() bool {
+	if c == nil || c.mgr == nil || c.mgr.st == nil || c.run.ProjectID == "" {
+		return false
+	}
+	host, ok := c.scratchHostFlag()
+	if !ok {
+		return true
+	}
+	return host
+}
+
+// confirmedScratchProject 只在存储里读到 host 标记后确认本次 run 是临时会话。
+// 读不到项目时为假且不缓存——“临时会话”在这个方向上是放宽信号（RDM 观察/预检
+// 门禁、项目上下文），一次读失败不能为整个 run 把它们放开。
+func (c *runCtx) confirmedScratchProject() bool {
+	host, ok := c.scratchHostFlag()
+	return ok && host
+}
+
+// projectWorkObservationApplies 报告本回合是否走 RDM 观察/预检通道。临时会话
+// 没有 RDM（provider 从未见过它），观察与预检门都不适用：它就是一次普通聊天。
+func (c *runCtx) projectWorkObservationApplies() bool {
+	return c.mgr.projectWorkObservationEnabled && c.run.ProjectID != "" && !c.confirmedScratchProject()
+}
+
+// authorizeProjectWork is the run-side project work gate. A scratch project is
+// never known to the domain provider (RDM would always report false), so the
+// stored ownership decides: its owner works without the provider, everyone else
+// is NotFound. Ordinary projects keep the provider decision unchanged.
 func (m *Manager) authorizeProjectWork(ctx context.Context, owner string, id core.ID) error {
+	if m.st != nil {
+		if handled, err := m.st.ScratchProjectDecision(string(id), owner); err != nil {
+			return err
+		} else if handled {
+			return nil
+		}
+	}
 	if m.projectWorkAuthorization == nil {
 		return nil
 	}
@@ -531,6 +595,11 @@ type runCtx struct {
 	launch              *workflow.Launch
 	files               *filestate.Tracker
 	permissionMode      string
+	// scratchHost 缓存本次 run 的基座项目是否为临时会话（U2 隔离门禁）；
+	// scratchKnown 为 false 表示还没判定成功过（读不到项目），不缓存未知答案。
+	scratchHost  bool
+	scratchKnown bool
+	scratchMu    sync.Mutex
 	// 材料整理（附件即保证）：预启动说明注入第 0 回合；ensureMaterial 兜底幂等。
 	materialNote    string
 	workContext     string
@@ -807,11 +876,17 @@ func (c *runCtx) Injections() []runtime.ContextInjection {
 	if err != nil {
 		return nil
 	}
+	// 临时会话只带本会话自己的上下文条目：owner 级/项目级条目会把别的会话的
+	// 材料带进来，与“私有会话”相反。
+	scratch := c.scratchProject()
 	out := make([]runtime.ContextInjection, 0, len(list))
 	for _, e := range list {
 		if !e.Enabled {
 			continue
 		}
+		if scratch && e.ConversationID != c.run.ConversationID {
+			continue
+		}
 		out = append(out, runtime.ContextInjection{
 			Keys: e.Keys, Secondary: e.Secondary, Logic: e.Logic, Content: e.Content,
 			Constant: e.Constant, ScanDepth: e.ScanDepth, BudgetChars: e.BudgetChars,
@@ -824,6 +899,11 @@ func (c *runCtx) Memories() []core.MemoryEntry {
 	if c.mgr == nil || c.mgr.st == nil {
 		return nil
 	}
+	// 临时会话不读 user/project 级记忆：记忆是跨会话的，正好是被隔离的那一层。
+	// 会话内状态（SessionNote）不受影响。
+	if c.scratchProject() {
+		return nil
+	}
 	list, err := c.mgr.st.ListMemory(c.run.Owner, "", "")
 	if err != nil {
 		return nil
@@ -843,7 +923,7 @@ func (c *runCtx) Emit(typ core.StreamEventType, payload any) error {
 	if err := c.mgr.authorizeRunWork(c.ctx, c.run.Owner, c.run.ProjectID); err != nil {
 		return err
 	}
-	if c.mgr.projectWorkObservationEnabled && c.run.ProjectID != "" && (typ == core.EvMessageDelta || typ == core.EvThinkingDelta) {
+	if c.projectWorkObservationApplies() && (typ == core.EvMessageDelta || typ == core.EvThinkingDelta) {
 		// Project reply text is released only through the committed message after
 		// the complete run-source manifest receives a domain risk decision.
 		return nil
@@ -1237,8 +1317,13 @@ func indexTextOf(name, mime string, content []byte) string {
 }
 
 func (c *runCtx) Retrieve(q core.RetrievalQuery) ([]core.RetrievalHit, error) {
+	// 临时会话没有可检索的共享知识：@knowledge 与 knowledge_search 一律空手
+	// 而非报错（会话里的附件仍以材料形式进入本回合）。
+	if c.scratchProject() {
+		return []core.RetrievalHit{}, nil
+	}
 	hits, err := c.retrieveRaw(q)
-	if err != nil || !c.mgr.projectWorkObservationEnabled || c.run.ProjectID == "" {
+	if err != nil || !c.projectWorkObservationApplies() {
 		return hits, err
 	}
 	for _, hit := range hits {
@@ -1364,7 +1449,7 @@ func (c *runCtx) ExecuteTool(call core.ToolCallRequest) core.ToolCallResult {
 			if ct.ID != call.Name {
 				continue
 			}
-			if c.mgr.projectWorkObservationEnabled && c.run.ProjectID != "" {
+			if c.projectWorkObservationApplies() {
 				return core.ToolCallResult{CallID: call.CallID, Status: "error", Output: "project command tool awaits trusted source preflight"}
 			}
 			var params map[string]any
@@ -1403,7 +1488,7 @@ func (c *runCtx) ExecuteTool(call core.ToolCallRequest) core.ToolCallResult {
 		last := tc.arts[len(tc.arts)-1]
 		res.Artifact = &last
 	}
-	if c.mgr.projectWorkObservationEnabled && c.run.ProjectID != "" {
+	if c.projectWorkObservationApplies() {
 		if call.CallID == "" {
 			return core.ToolCallResult{CallID: call.CallID, Status: "error", Output: "project tool result lacks a stable call ID"}
 		}
@@ -1494,7 +1579,11 @@ var (
 )
 
 // crossReadSelf 加载当前会话并校验项目闸门；出站检查由调用方按目标是否为自身决定。
+// 临时会话直接关闭出站读取：它的材料不流向任何其他会话（U2）。
 func (t *toolCtx) crossReadSelf() (core.Conversation, error) {
+	if t.rc.scratchProject() {
+		return core.Conversation{}, ErrCrossReadDisabled
+	}
 	if !t.rc.eff.GetBool("crossSession.read", false) {
 		return core.Conversation{}, ErrCrossReadDisabled
 	}
@@ -1505,6 +1594,20 @@ func (t *toolCtx) crossReadSelf() (core.Conversation, error) {
 	return self, nil
 }
 
+// scratchPeer reports whether a conversation lives in a scratch project. Peers are
+// grouped by project so the trusted lookup runs once per distinct project.
+func (t *toolCtx) scratchPeer(c core.Conversation, cache map[core.ID]bool) bool {
+	if seen, ok := cache[c.ProjectID]; ok {
+		return seen
+	}
+	scratch, err := t.rc.mgr.st.IsScratchProjectID(string(c.ProjectID))
+	if err != nil {
+		scratch = false
+	}
+	cache[c.ProjectID] = scratch
+	return scratch
+}
+
 func (t *toolCtx) PeerConversations() ([]core.Conversation, error) {
 	self, err := t.crossReadSelf()
 	if err != nil {
@@ -1517,12 +1620,17 @@ func (t *toolCtx) PeerConversations() ([]core.Conversation, error) {
 	if err != nil {
 		return nil, err
 	}
+	scratchProjects := map[core.ID]bool{}
 	out := make([]core.Conversation, 0, len(convs))
 	for _, c := range convs {
 		// 只读他人：排除自身；私有会话不出现（存在性本身是信息）。
 		if c.ID == self.ID || c.CrossPrivate {
 			continue
 		}
+		// 临时会话永不作为同伴出现：它不是共享材料，而是别人的私有会话。
+		if t.scratchPeer(c, scratchProjects) {
+			continue
+		}
 		out = append(out, c)
 	}
 	return out, nil
@@ -1548,6 +1656,10 @@ func (t *toolCtx) PeerConversationMessages(conversationID string, limit int) ([]
 	if !isSelf && !self.AllowCrossRead {
 		return nil, ErrCrossReadDisabled
 	}
+	// 临时会话的材料不出会话：即使同租户、即使未标私有也拒（自读除外）。
+	if !isSelf && t.scratchPeer(target, map[core.ID]bool{}) {
+		return nil, ErrCrossReadForbidden
+	}
 	if !isSelf && (target.CrossPrivate || target.ProjectID != t.rc.run.ProjectID) {
 		return nil, ErrCrossReadForbidden
 	}

internal/runmgr/runmgr_test.go

@@ -217,6 +217,24 @@ func TestResolveHITLSecondRoundKeepsTerminalStatus(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		t.Fatal("runner did not reach the second HITL question")
 	}
+	// asked 只保证 runner 已经发出提问，不保证 waiting_hitl 行与卡片都已落库；
+	// 与第 1 轮同一序列：等 run 处于 waiting_hitl 且存在未解决卡片后再读取。
+	waitUntilWithin(t, 10*time.Second, func() bool {
+		got, err := st.GetRunByID(run.ID)
+		if err != nil || got.Status != core.RunWaitingHITL {
+			return false
+		}
+		cards, err := st.ActiveHITLCards(conv.Owner, conv.ID)
+		if err != nil {
+			return false
+		}
+		for _, c := range cards {
+			if !c.Resolved {
+				return true
+			}
+		}
+		return false
+	})
 	second := pendingCard(t, st, conv, 1)
 	if got, err := st.GetRunByID(run.ID); err != nil || got.Status != core.RunWaitingHITL {
 		t.Fatalf("round 2 status=%s err=%v (want waiting_hitl)", got.Status, err)

internal/runmgr/scratch_gates_test.go

@@ -0,0 +1,464 @@
+package runmgr
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+
+	"agent-native/runtime/memory"
+	"agent-system-backend/internal/settings"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+// 临时会话隔离门禁（U2，runmgr 侧）。产品规则：临时会话是“只属于自己的通用代理
+// 会话”——属主的回合像普通聊天一样跑，但它不读检索、不带 owner/项目级上下文、
+// 不读不写跨会话记忆、也不与任何会话互相读。
+
+type scratchRunEnv struct {
+	mgr      *Manager
+	st       *store.Store
+	svc      *settings.Service
+	project  core.Project // scratch 宿主项目
+	scratch  core.Conversation
+	normal   core.Project
+	normalAt core.Conversation // 普通项目的调用方会话
+	peer     core.Conversation // 普通项目的同伴会话
+}
+
+func newScratchRunEnv(t *testing.T) *scratchRunEnv {
+	t.Helper()
+	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "scratch.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if err := st.CreateAccount("alice", "Alice", "", false); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.CreateAccount("bob", "Bob", "", false); err != nil {
+		t.Fatal(err)
+	}
+	env := &scratchRunEnv{st: st, mgr: &Manager{st: st}, svc: settings.NewService(st)}
+	project, conversation, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	env.project, env.scratch = project, conversation
+	normal, err := st.CreateProject("alice", "普通项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	env.normal = normal
+	if env.normalAt, err = st.CreateConversation("alice", normal.ID, "调用方", ""); err != nil {
+		t.Fatal(err)
+	}
+	if env.peer, err = st.CreateConversation("alice", normal.ID, "同伴", ""); err != nil {
+		t.Fatal(err)
+	}
+	msg := core.Message{ConversationID: env.peer.ID, Role: core.RoleUser, Parts: []core.Part{{Type: core.PartText, Text: "同伴内容"}}}
+	if err := st.AppendMessage(&msg); err != nil {
+		t.Fatal(err)
+	}
+	return env
+}
+
+// runCtx 造一次“回合视角”：项目 + 会话 + 属主。
+func (e *scratchRunEnv) runCtx(projectID, conversationID, owner string) *runCtx {
+	return &runCtx{mgr: e.mgr, eff: e.svc.Effective(owner, projectID),
+		run: core.Run{ID: "run-1", Owner: core.ID(owner), ProjectID: core.ID(projectID), ConversationID: core.ID(conversationID)}}
+}
+
+func (e *scratchRunEnv) scratchCtx() *runCtx {
+	return e.runCtx(string(e.project.ID), e.scratch.ID, "alice")
+}
+
+func (e *scratchRunEnv) normalCtx() *runCtx {
+	return e.runCtx(string(e.normal.ID), e.normalAt.ID, "alice")
+}
+
+// 门禁①：runmgr.authorizeRunWork —— 领域 provider 恒 false 时，scratch 属主照常
+// 工作（provider 从未见过这个项目），其他人 NotFound；普通项目仍由 provider 决定。
+func TestScratchRunWorkUsesOwnerInsteadOfDomainProvider(t *testing.T) {
+	env := newScratchRunEnv(t)
+	asked := 0
+	env.mgr.SetProjectWorkAuthorization(func(context.Context, string, core.ID) (bool, error) {
+		asked++
+		return false, nil // RDM 视角：永远没有这个项目
+	})
+	scratchID := core.ID(env.project.ID)
+
+	if err := env.mgr.authorizeRunWork(context.Background(), "alice", scratchID); err != nil {
+		t.Fatalf("scratch owner blocked by the domain provider: %v", err)
+	}
+	if asked != 0 {
+		t.Fatalf("scratch owner work consulted the provider %d times", asked)
+	}
+	if err := env.mgr.authorizeRunWork(context.Background(), "bob", scratchID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("non-owner reached a scratch run: %v", err)
+	}
+	// 负面：普通项目没有被这条门禁放宽。
+	if err := env.mgr.authorizeRunWork(context.Background(), "alice", core.ID(env.normal.ID)); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("normal project bypassed the provider decision: %v", err)
+	}
+	// 正面：provider 放行的普通项目照旧放行。
+	env.mgr.SetProjectWorkAuthorization(func(context.Context, string, core.ID) (bool, error) { return true, nil })
+	if err := env.mgr.authorizeRunWork(context.Background(), "alice", core.ID(env.normal.ID)); err != nil {
+		t.Fatalf("provider-approved normal project blocked: %v", err)
+	}
+	// 无 provider 注册时，非属主仍然进不去 scratch。
+	env.mgr.projectWorkAuthorization = nil
+	if err := env.mgr.authorizeRunWork(context.Background(), "bob", scratchID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("unregistered host opened a scratch run for a non-owner: %v", err)
+	}
+}
+
+// 门禁②：RDM 预检/观察通道不适用于临时会话。
+func TestScratchRunSkipsDomainPreflightGate(t *testing.T) {
+	env := newScratchRunEnv(t)
+	preflights := 0
+	env.mgr.SetProjectWorkGate(
+		func(context.Context, string, string) (extension.ProjectWorkDecision, error) {
+			preflights++
+			return extension.ProjectWorkDecision{State: extension.ProjectWorkProceed, DecisionID: "d1"}, nil
+		},
+		func(context.Context, extension.ProjectRiskAnswer) (extension.ProjectWorkDecision, error) {
+			return extension.ProjectWorkDecision{State: extension.ProjectWorkProceed, DecisionID: "d1"}, nil
+		},
+	)
+	rc := env.scratchCtx()
+	rc.h = &runHandle{}
+	if err := rc.requireProjectWorkDecision("conversation.run"); err != nil {
+		t.Fatalf("scratch run hit the domain preflight: %v", err)
+	}
+	if preflights != 0 {
+		t.Fatalf("scratch run called the domain preflight %d times", preflights)
+	}
+	if rc.projectWorkObservationApplies() {
+		t.Fatal("scratch run must not enter the RDM observation channel")
+	}
+}
+
+// 门禁③：项目上下文（X1）即使 provider 已注册也不装配。
+func TestScratchProjectContextDisabled(t *testing.T) {
+	env := newScratchRunEnv(t)
+	resolved := 0
+	env.mgr.SetProjectContextResolver(func(context.Context, extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+		resolved++
+		return extension.ProjectContextBundle{ProjectID: env.project.ID}, nil
+	})
+	if env.scratchCtx().ProjectContextEnabled() {
+		t.Fatal("scratch run assembled project context")
+	}
+	if resolved != 0 {
+		t.Fatalf("scratch run resolved project context %d times", resolved)
+	}
+	// 正面：普通项目照旧启用。
+	if !env.normalCtx().ProjectContextEnabled() {
+		t.Fatal("normal project lost project context")
+	}
+}
+
+// 门禁③bis：ProjectContext 本身（llm.go refresh.ProjectContext、GuardProjectStream
+// 与其它调用方走的同一个入口）在临时会话回合里一次 resolver 都不调；普通项目的
+// 回合照旧调用。
+func TestScratchProjectContextNeverReachesResolver(t *testing.T) {
+	env := newScratchRunEnv(t)
+	env.mgr.SetProjectWorkAuthorization(func(context.Context, string, core.ID) (bool, error) { return true, nil })
+	resolved := 0
+	env.mgr.SetProjectContextResolver(func(_ context.Context, req extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+		resolved++
+		return extension.ProjectContextBundle{Status: extension.ProjectContextReady, ProjectID: req.ProjectID}, nil
+	})
+
+	bundle, active, err := env.scratchCtx().ProjectContext(context.Background(), "临时会话的目标", 900)
+	if err != nil || active {
+		t.Fatalf("scratch ProjectContext = active:%v err:%v", active, err)
+	}
+	if bundle.Status != "" || bundle.ProjectID != "" || len(bundle.Items) != 0 || len(bundle.Evidence) != 0 {
+		t.Fatalf("scratch ProjectContext returned a bundle: %+v", bundle)
+	}
+	if resolved != 0 {
+		t.Fatalf("scratch run called the project context resolver %d times", resolved)
+	}
+	// ProjectEvidence 同样不得借此拿到材料。
+	if _, err := env.scratchCtx().ProjectEvidence(context.Background(), "ref-a"); err == nil {
+		t.Fatal("scratch run read project evidence")
+	}
+
+	// 正面：普通项目的已持久化 run 照旧装一次上下文。
+	run := core.Run{ConversationID: env.normalAt.ID, ProjectID: env.normal.ID, Owner: env.normalAt.Owner,
+		Kind: core.RunConversation, Status: core.RunPending, Phase: core.PhaseThinking}
+	if err := env.st.CreateRun(&run); err != nil {
+		t.Fatal(err)
+	}
+	normalRC := env.runCtx(string(env.normal.ID), string(env.normalAt.ID), string(env.normalAt.Owner))
+	normalRC.run = run
+	if _, active, err := normalRC.ProjectContext(context.Background(), "普通项目的目标", 900); err != nil || !active {
+		t.Fatalf("normal project ProjectContext = active:%v err:%v", active, err)
+	}
+	if resolved != 1 {
+		t.Fatalf("normal run called the project context resolver %d times, want 1", resolved)
+	}
+}
+
+// 门禁③ter：基座项目读不到时 fail closed——本次调用按临时会话处理，且不把这个
+// 未知答案缓存下来（否则一次读失败就会为整个 run 放开记忆、上下文条目与跨会话读取）。
+func TestScratchProjectFailsClosedOnLookupError(t *testing.T) {
+	env := newScratchRunEnv(t)
+	rc := env.runCtx("prj-missing", string(env.scratch.ID), "alice")
+	if !rc.scratchProject() {
+		t.Fatal("unreadable host project was treated as a normal project")
+	}
+	// 未缓存未知答案：换成能读到的项目后重新判定（缓存 false 会在这里露馅）。
+	rc.run.ProjectID = env.project.ID
+	if !rc.scratchProject() {
+		t.Fatal("real scratch project was not recognised after a failed lookup")
+	}
+	// 正面：读得到时按存储标记判定，普通项目不受影响。
+	normal := env.runCtx(string(env.normal.ID), string(env.normalAt.ID), "alice")
+	if normal.scratchProject() {
+		t.Fatal("normal project was treated as scratch")
+	}
+	scratch := env.runCtx(string(env.project.ID), string(env.scratch.ID), "alice")
+	if !scratch.scratchProject() {
+		t.Fatal("scratch project was not recognised")
+	}
+	// 无项目 run 不受影响（没有基座项目就没有临时会话可谈）。
+	if env.runCtx("", string(env.scratch.ID), "alice").scratchProject() {
+		t.Fatal("projectless run was treated as scratch")
+	}
+}
+
+// 门禁③quater：同一件事（基座项目读不到）在两个方向上都 fail closed。收紧型门禁
+// （记忆、上下文条目、检索、跨会话读取、记忆端口）按临时会话处理；放宽型门禁（RDM
+// 观察/预检、项目上下文）按普通项目处理。读到标记之前谁都不能被一次读失败固定下来。
+func TestScratchGatesFailClosedBothWaysOnLookupError(t *testing.T) {
+	env := newScratchRunEnv(t)
+	preflights := 0
+	configure := func(mgr *Manager) {
+		mgr.SetProjectWorkGate(
+			func(context.Context, string, string) (extension.ProjectWorkDecision, error) {
+				preflights++
+				return extension.ProjectWorkDecision{}, errors.New("domain preflight unreachable")
+			},
+			func(context.Context, extension.ProjectRiskAnswer) (extension.ProjectWorkDecision, error) {
+				return extension.ProjectWorkDecision{}, errors.New("domain preflight unreachable")
+			},
+		)
+		mgr.SetProjectContextResolver(func(context.Context, extension.ProjectContextRequest) (extension.ProjectContextBundle, error) {
+			return extension.ProjectContextBundle{}, nil
+		})
+	}
+	configure(env.mgr)
+
+	// 基线：普通项目上，两个方向本来就是收紧（不隔离）/ 放宽门生效（观察+上下文）。
+	before := env.normalCtx()
+	if before.scratchProject() {
+		t.Fatal("normal project was treated as scratch")
+	}
+	if !before.projectWorkObservationApplies() {
+		t.Fatal("normal project lost the RDM observation channel")
+	}
+	if !before.ProjectContextEnabled() {
+		t.Fatal("normal project lost project context")
+	}
+
+	// 关掉存储句柄：项目行没变（仍是普通项目），只是 host 标记读不到了。
+	if err := env.st.Close(); err != nil {
+		t.Fatal(err)
+	}
+	rc := env.normalCtx()
+	if !rc.scratchProject() {
+		t.Fatal("unreadable host project stopped tightening the isolation gates")
+	}
+	if !rc.projectWorkObservationApplies() {
+		t.Fatal("a failed scratch lookup skipped the RDM observation/preflight gate")
+	}
+	if !rc.ProjectContextEnabled() {
+		t.Fatal("a failed scratch lookup disabled project context for a normal project")
+	}
+	// 观察门真的走到领域预检：门没有因为读不到标记而被整体跳过。
+	rc.h = &runHandle{}
+	if err := rc.requireProjectWorkDecision("conversation.run"); err == nil {
+		t.Fatal("project work gate skipped the domain preflight after a failed lookup")
+	}
+	if preflights != 1 {
+		t.Fatalf("domain preflight consulted %d times after a failed lookup, want 1", preflights)
+	}
+
+	// 未缓存未知答案：读失败后在能读到的存储上重新判定，两个方向都只认存储标记。
+	again := newScratchRunEnv(t)
+	configure(again.mgr)
+	probe := again.runCtx("prj-missing", string(again.scratch.ID), "alice")
+	if !probe.scratchProject() || probe.confirmedScratchProject() {
+		t.Fatalf("failed lookup did not split the two directions: isolation=%t relaxing=%t",
+			probe.scratchProject(), probe.confirmedScratchProject())
+	}
+	probe.run.ProjectID = again.project.ID
+	if !probe.scratchProject() || !probe.confirmedScratchProject() {
+		t.Fatal("real scratch project was not recognised after a failed lookup")
+	}
+	normal := again.normalCtx()
+	if normal.scratchProject() || normal.confirmedScratchProject() {
+		t.Fatal("normal project was cached as scratch after a failed lookup")
+	}
+	if !normal.projectWorkObservationApplies() || !normal.ProjectContextEnabled() {
+		t.Fatal("readable normal project lost the observation gate or project context")
+	}
+	// 真实临时会话依旧拿不到这些放宽面。
+	if scratch := again.scratchCtx(); scratch.projectWorkObservationApplies() || scratch.ProjectContextEnabled() {
+		t.Fatal("scratch project gained the RDM observation gate or project context")
+	}
+}
+
+// 门禁④：检索为空 —— @knowledge / knowledge_search 在临时会话里拿不到任何东西。
+func TestScratchRunRetrievalReturnsNoHits(t *testing.T) {
+	env := newScratchRunEnv(t)
+	docs := []core.KnowledgeDoc{
+		{Owner: "alice", ProjectID: core.ID(env.project.ID), Source: "manual", Title: "临时项目文档", Chunk: "临时会话项目内的文档"},
+		{Owner: "alice", Source: "manual", Title: "属主文档", Chunk: "属主全局文档"},
+	}
+	if err := env.st.AddKnowledge(docs...); err != nil {
+		t.Fatal(err)
+	}
+	query := core.RetrievalQuery{Text: "文档", TopK: 10}
+
+	hits, err := env.scratchCtx().Retrieve(query)
+	if err != nil || len(hits) != 0 {
+		t.Fatalf("scratch retrieval must return no hits: %+v %v", hits, err)
+	}
+	// 工具面（toolCtx.Retrieve）同样空手。
+	tc := &toolCtx{rc: env.scratchCtx(), callID: "call-1"}
+	if hits, err := tc.Retrieve(query); err != nil || len(hits) != 0 {
+		t.Fatalf("scratch tool retrieval must return no hits: %+v %v", hits, err)
+	}
+	// 正面：普通项目照旧检索得到（这里是项目文档 + 属主文档）。
+	hits, err = env.normalCtx().Retrieve(query)
+	if err != nil || len(hits) == 0 {
+		t.Fatalf("normal project retrieval lost hits: %+v %v", hits, err)
+	}
+}
+
+// 门禁⑤：上下文注入只留本会话条目；记忆不读不写。
+func TestScratchRunKeepsNoSharedContextAndNoMemory(t *testing.T) {
+	env := newScratchRunEnv(t)
+	// 三种作用域各一条：属主级、项目级（本临时会话项目）、本会话级。
+	for _, entry := range []store.ContextEntry{
+		{Keys: []string{"owner"}, Content: "属主级上下文", Enabled: true},
+		{Keys: []string{"project"}, ProjectID: env.project.ID, Content: "项目级上下文", Enabled: true},
+		{Keys: []string{"conversation"}, ProjectID: env.project.ID, ConversationID: env.scratch.ID, Content: "本会话上下文", Enabled: true},
+	} {
+		if _, err := env.st.SaveContextEntry("alice", entry); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got := map[string]string{}
+	for _, inj := range env.scratchCtx().Injections() {
+		for _, key := range inj.Keys {
+			got[key] = inj.Content
+		}
+	}
+	if got["conversation"] != "本会话上下文" {
+		t.Fatalf("scratch run lost its own context entry: %+v", got)
+	}
+	if _, ok := got["owner"]; ok {
+		t.Fatalf("owner-wide context entry leaked into a scratch run: %+v", got)
+	}
+	if _, ok := got["project"]; ok {
+		t.Fatalf("project-wide context entry leaked into a scratch run: %+v", got)
+	}
+	// 正面：普通项目的回合仍然带属主级上下文。
+	normalInj := map[string]bool{}
+	for _, inj := range env.normalCtx().Injections() {
+		for _, key := range inj.Keys {
+			normalInj[key] = true
+		}
+	}
+	if !normalInj["owner"] {
+		t.Fatalf("normal run lost owner-wide context: %+v", normalInj)
+	}
+
+	// 记忆：临时会话既不读也不写 user/project 记忆。
+	if _, err := env.st.PutMemory("alice", core.MemoryEntry{Scope: "user", Type: "note", Content: "属主记忆", Confidence: 0.9}); err != nil {
+		t.Fatal(err)
+	}
+	if entries := env.scratchCtx().Memories(); len(entries) != 0 {
+		t.Fatalf("scratch run read user memory: %+v", entries)
+	}
+	if entries := env.normalCtx().Memories(); len(entries) != 1 || entries[0].Content != "属主记忆" {
+		t.Fatalf("normal run lost user memory: %+v", entries)
+	}
+
+	scratchPort := env.scratchCtx().StoreMemory()
+	if entries, err := scratchPort.Recall(context.Background(), memory.RecallQuery{Scope: "user"}); err != nil || len(entries) != 0 {
+		t.Fatalf("scratch memory port recalled: %+v %v", entries, err)
+	}
+	if err := scratchPort.Append(context.Background(), memory.Entry{Scope: "user", Type: "note", Content: "临时记忆"}); !errors.Is(err, ErrScratchMemory) {
+		t.Fatalf("scratch memory port accepted a user-scope write: %v", err)
+	}
+	if err := scratchPort.Append(context.Background(), memory.Entry{Scope: "project", Type: "note", Content: "临时项目记忆"}); !errors.Is(err, ErrScratchMemory) {
+		t.Fatalf("scratch memory port accepted a project-scope write: %v", err)
+	}
+	if entries, err := env.st.ListMemory("alice", "", ""); err != nil || len(entries) != 1 {
+		t.Fatalf("refused writes reached the store: %+v %v", entries, err)
+	}
+	// 正面：普通项目的记忆端口照常读写。
+	normalPort := env.normalCtx().StoreMemory()
+	if err := normalPort.Append(context.Background(), memory.Entry{Scope: "user", Type: "note", Content: "普通记忆"}); err != nil {
+		t.Fatalf("normal memory port write: %v", err)
+	}
+	if entries, err := normalPort.Recall(context.Background(), memory.RecallQuery{Scope: "user"}); err != nil || len(entries) < 2 {
+		t.Fatalf("normal memory port recall: %+v %v", entries, err)
+	}
+}
+
+// 门禁⑥：跨会话读取 —— 临时会话读不到别人；别人的列表里也没有临时会话。
+func TestScratchCrossSessionReadIsIsolated(t *testing.T) {
+	env := newScratchRunEnv(t)
+	// 临时会话自己的项目开关：即使显式开闸也不放行。
+	if err := env.svc.MergeProject("alice", string(env.project.ID), map[string]any{"crossSession": map[string]any{"read": true}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := env.svc.MergeProject("alice", string(env.normal.ID), map[string]any{"crossSession": map[string]any{"read": true}}); err != nil {
+		t.Fatal(err)
+	}
+
+	scratchTool := &toolCtx{rc: env.scratchCtx(), callID: "call-1"}
+	if _, err := scratchTool.PeerConversations(); !errors.Is(err, ErrCrossReadDisabled) {
+		t.Fatalf("scratch run listed peers: %v", err)
+	}
+	if _, err := scratchTool.PeerConversationMessages(env.peer.ID, 0); !errors.Is(err, ErrCrossReadDisabled) {
+		t.Fatalf("scratch run read a peer: %v", err)
+	}
+
+	normalTool := &toolCtx{rc: env.normalCtx(), callID: "call-2"}
+	convs, err := normalTool.PeerConversations()
+	if err != nil {
+		t.Fatalf("normal peer listing: %v", err)
+	}
+	for _, c := range convs {
+		if c.ID == env.scratch.ID {
+			t.Fatalf("scratch conversation showed up in a normal peer list: %+v", convs)
+		}
+	}
+	found := false
+	for _, c := range convs {
+		if c.ID == env.peer.ID {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("normal peer listing lost the real peer: %+v", convs)
+	}
+	if _, err := normalTool.PeerConversationMessages(env.scratch.ID, 0); !errors.Is(err, ErrCrossReadForbidden) {
+		t.Fatalf("normal run read a scratch conversation: %v", err)
+	}
+	// 正面：普通项目的同伴会话照旧可读。
+	if msgs, err := normalTool.PeerConversationMessages(env.peer.ID, 0); err != nil || len(msgs) != 1 {
+		t.Fatalf("normal peer read: %+v %v", msgs, err)
+	}
+}

internal/runtime/hostbridge.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 
 	"agent-native/adapters/native"
 	"agent-native/runtime/tools"
@@ -25,14 +26,30 @@ type producedSink interface {
 	add(ref *core.ArtifactRef)
 }
 
+// artifactList 是本次运行已登记的工件表。宿主工具可能被内核并行调用，
+// 因此写入与读取都在同一把锁下：并发调用既不丢条目也不读到半成品。
 type artifactList struct {
+	mu    sync.Mutex
 	items []*core.ArtifactRef
 }
 
 func (a *artifactList) add(ref *core.ArtifactRef) {
-	if ref != nil {
-		a.items = append(a.items, ref)
+	if ref == nil {
+		return
 	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.items = append(a.items, ref)
+}
+
+// snapshot 返回当前工件的副本，供终局检查与部件装配使用。
+func (a *artifactList) snapshot() []*core.ArtifactRef {
+	if a == nil {
+		return nil
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return append([]*core.ArtifactRef(nil), a.items...)
 }
 
 // bridgeHostTools 把画像允许的产品工具包成内核宿主工具。

internal/runtime/llm.go

@@ -252,7 +252,7 @@ func (l *LLMRunner) Execute(rc RunCtx) error {
 	if stream == nil {
 		// 重试经库默认（WP6：runtime.llmRetries → Config.RetryAttempts 映射），
 		// 此处不再显式包装（防双重）。
-		client := openRouteClient(route, eff)
+		client := OpenRouteClient(route, eff)
 		stream = client.Stream
 	}
 	stream = annotateKeyFailure(stream, route)
@@ -601,13 +601,6 @@ func openLLMClient(base, key, model string) *agentllm.Client {
 	return c
 }
 
-// openRouteClient 按一次解析出的路由构造客户端，并为该路由独立判定 RouteContract。
-func openRouteClient(route ResolvedModel, eff core.EffectiveSettings) *agentllm.Client {
-	c := openLLMClient(route.Base, route.Key, route.Model)
-	c.RouteContract = routeContractFor(eff, route)
-	return c
-}
-
 // routeContractFor 只看本客户端实际解析出的 model 与 base，不看 route.Kind，
 // 也不读画像：三项系统设置任一为空、模型名不逐字相等、规范化后的端点与配置
 // 不逐字相等（配置本身须已是规范形态）或身份摘要不符，都返回 nil（关闭）。

internal/runtime/llm_direct.go

@@ -110,6 +110,13 @@ type toolEvidence struct {
 	VerifyText string // 给验证器的尾部摘要，比界面上的摘要长
 }
 
+// toolSlot 是一次在途工具调用的过程状态。
+//
+// 并行工具执行下槽位有两个并发访问方：工具 goroutine 回写结果字段，
+// 内核事件回调（onEvent 的 tool_execution_end）在 toolMu 下读它们装部件。
+// 字段一律经 directRun.writeSlot 在 toolMu 下访问，直接写即数据竞争。
+// claimed 只在 toolMu 下访问：并行且无 ctx 注入的调用（宿主 UnknownTool
+// 直调）按认领取槽位，两个 goroutine 不会写同一个槽位、结果不会互相覆盖。
 type toolSlot struct {
 	call       agentllm.ToolCall
 	start      time.Time
@@ -117,6 +124,7 @@ type toolSlot struct {
 	verifyText string
 	status     string
 	truncated  bool
+	claimed    bool // 已被某次工具执行认领（无注入路径据此避免撞槽）
 	artifact   *core.ArtifactRef
 }
 
@@ -565,9 +573,11 @@ func (l *LLMRunner) runDirect(rc RunCtx, stream agentllm.StreamFunc, model strin
 // 摘要/状态/验证文本在这里补记，保证过程面板与终轮验证器看到同样的证据。
 func (st *directRun) noteKernelResult(ctx context.Context, res agenttools.Result) {
 	call, ok := nruntime.ToolCallFromContext(ctx)
-	slot := st.slotFor("")
-	if ok {
+	var slot *toolSlot
+	if ok && call.ID != "" {
 		slot = st.slotFor(call.ID)
+	} else {
+		slot = st.slotFor("")
 	}
 	if slot == nil {
 		return
@@ -576,28 +586,74 @@ func (st *directRun) noteKernelResult(ctx context.Context, res agenttools.Result
 	if res.IsError {
 		summary = "error: " + summary
 	}
-	slot.summary = summary
-	slot.status = statusOf(nil)
+	status := statusOf(nil)
 	if res.IsError {
-		slot.status = "error"
+		status = "error"
 	}
-	slot.verifyText = tailRunes(res.Content, 600)
+	verifyText := tailRunes(res.Content, 600)
+	st.writeSlot(slot, func(s *toolSlot) {
+		s.summary = summary
+		s.status = status
+		s.verifyText = verifyText
+	})
 }
 
-// slotFor 按调用 ID 取在途槽位；ID 为空且恰有一个槽位时取之（兼容无注入
-// 的调用路径）。返回的指针仅供本次工具执行内写回，不跨事件持有。
+// writeSlot 在 toolMu 下回写在途槽位：工具 goroutine 写、事件回调读的是同一
+// 块内存，只有同一把锁才能给出 happens-before。
+func (st *directRun) writeSlot(slot *toolSlot, apply func(*toolSlot)) {
+	if slot == nil {
+		return
+	}
+	st.toolMu.Lock()
+	defer st.toolMu.Unlock()
+	apply(slot)
+}
+
+// appendFinalPart 在 toolMu 下追加最终部件：并行工具执行（工件门面卡、卡片
+// 工具）与事件回调共享同一片 finalParts。
+func (st *directRun) appendFinalPart(parts ...core.Part) {
+	st.toolMu.Lock()
+	defer st.toolMu.Unlock()
+	st.finalParts = append(st.finalParts, parts...)
+}
+
+// markExplicitCard / cardSuppressed 记「模型已自己发过卡片」：写方是卡片工具
+// （保序执行，仍与并行工具 goroutine 同时在跑），读方是工件门面卡分支。
+func (st *directRun) markExplicitCard() {
+	st.toolMu.Lock()
+	defer st.toolMu.Unlock()
+	st.explicitCard = true
+}
+
+func (st *directRun) cardSuppressed() bool {
+	st.toolMu.Lock()
+	defer st.toolMu.Unlock()
+	return st.explicitCard
+}
+
+// slotFor 按调用 ID 取在途槽位；ID 为空时认领一个尚未被认领的槽位（兼容无
+// 注入的调用路径）。返回的指针仅供本次工具执行内写回，不跨事件持有。
 func (st *directRun) slotFor(callID string) *toolSlot {
 	st.toolMu.Lock()
 	defer st.toolMu.Unlock()
 	if callID != "" {
-		return st.inflight[callID]
+		slot := st.inflight[callID]
+		if slot != nil {
+			slot.claimed = true
+		}
+		return slot
 	}
-	if len(st.inflight) == 1 {
-		for _, slot := range st.inflight {
-			return slot
+	var free *toolSlot
+	for _, slot := range st.inflight {
+		if !slot.claimed {
+			free = slot
+			break
 		}
 	}
-	return nil
+	if free != nil {
+		free.claimed = true
+	}
+	return free
 }
 
 // noteToolDelta 把模型正在编写的工具参数立刻转成会话事件。
@@ -725,18 +781,22 @@ func (st *directRun) onEvent(ev nruntime.Event) {
 			st.toolMu.Unlock()
 			return
 		}
+		// 锁内快照结果字段：工具回写（并行工具 goroutine）与本回调分属两个
+		// goroutine，解锁后再读槽位字段即数据竞争，事件只带快照走。
+		call, start := slot.call, slot.start
+		status, summary, truncated := slot.status, slot.summary, slot.truncated
 		end := st.l.now()
 		st.finalParts = append(st.finalParts,
-			core.Part{Type: core.PartToolCall, Process: true, ToolCall: &core.ToolCallPart{ID: slot.call.ID, Name: slot.call.Name, Arguments: slot.call.Arguments, Duration: durationMs(slot.start, end)}},
-			core.Part{Type: core.PartToolResult, Process: true, ToolResult: &core.ToolResultPart{CallID: slot.call.ID, Status: slot.status, Summary: slot.summary}},
+			core.Part{Type: core.PartToolCall, Process: true, ToolCall: &core.ToolCallPart{ID: call.ID, Name: call.Name, Arguments: call.Arguments, Duration: durationMs(start, end)}},
+			core.Part{Type: core.PartToolResult, Process: true, ToolResult: &core.ToolResultPart{CallID: call.ID, Status: status, Summary: summary}},
 		)
 		if slot.artifact != nil {
 			st.deliverables = append(st.deliverables, slot.artifact)
 		}
-		st.evidence = append(st.evidence, toolEvidence{Name: slot.call.Name, Status: slot.status, Summary: slot.summary, VerifyText: slot.verifyText})
+		st.evidence = append(st.evidence, toolEvidence{Name: call.Name, Status: status, Summary: summary, VerifyText: slot.verifyText})
 		st.toolMu.Unlock()
-		st.noteFailureOutcome(slot.status)
-		_ = st.rc.Emit(core.EvToolResult, core.ToolResultPayload{CallID: slot.call.ID, Status: slot.status, Summary: slot.summary, Truncated: slot.truncated, DurationMs: durationMs(slot.start, end)})
+		st.noteFailureOutcome(status)
+		_ = st.rc.Emit(core.EvToolResult, core.ToolResultPayload{CallID: call.ID, Status: status, Summary: summary, Truncated: truncated, DurationMs: durationMs(start, end)})
 	}
 }
 
@@ -1129,17 +1189,17 @@ func (st *directRun) runToolCtx(ctx context.Context, name, args string) agenttoo
 			}
 		}
 		if res.Artifact != nil && slot != nil {
-			slot.artifact = &core.ArtifactRef{ArtifactID: res.Artifact.ID, Name: res.Artifact.Name, Kind: res.Artifact.Kind}
-			if st.cardflow && res.Truncated && !st.explicitCard {
+			st.writeSlot(slot, func(s *toolSlot) {
+				s.artifact = &core.ArtifactRef{ArtifactID: res.Artifact.ID, Name: res.Artifact.Name, Kind: res.Artifact.Kind}
+			})
+			if st.cardflow && res.Truncated && !st.cardSuppressed() {
 				fc, ferr := st.rc.SubmitCard(artifactFacadeCard(call.Name, *res.Artifact, summarize(out, nil)))
 				if ferr == nil {
-					st.finalParts = append(st.finalParts, core.Part{Type: core.PartCard, Card: &core.CardPart{Kind: string(core.CardKindResult), CardID: fc.ID}})
+					st.appendFinalPart(core.Part{Type: core.PartCard, Card: &core.CardPart{Kind: string(core.CardKindResult), CardID: fc.ID}})
 				}
 			}
 		}
-		if slot != nil {
-			slot.truncated = res.Truncated
-		}
+		st.writeSlot(slot, func(s *toolSlot) { s.truncated = res.Truncated })
 	}
 
 	summary := summarize(out, nil)
@@ -1148,11 +1208,12 @@ func (st *directRun) runToolCtx(ctx context.Context, name, args string) agenttoo
 		summary = "error: " + err.Error()
 		out = summary
 	}
-	if slot != nil {
-		slot.summary = summary
-		slot.status = status
-		slot.verifyText = tailRunes(out, 600)
-	}
+	verifyText := tailRunes(out, 600)
+	st.writeSlot(slot, func(s *toolSlot) {
+		s.summary = summary
+		s.status = status
+		s.verifyText = verifyText
+	})
 	if r := []rune(out); len(r) > 16000 {
 		out = string(r[:16000]) + "…（超长截断）"
 	}
@@ -1257,8 +1318,8 @@ func (st *directRun) submitCard(args string) string {
 	if cerr != nil {
 		return "submit_card 失败: " + cerr.Error()
 	}
-	st.finalParts = append(st.finalParts, core.Part{Type: core.PartCard, Card: &core.CardPart{Kind: string(core.CardKindResult), CardID: card.ID}})
-	st.explicitCard = true
+	st.appendFinalPart(core.Part{Type: core.PartCard, Card: &core.CardPart{Kind: string(core.CardKindResult), CardID: card.ID}})
+	st.markExplicitCard()
 	where := "对话"
 	if a.Scope == "project" {
 		where = "项目"
@@ -1311,18 +1372,21 @@ func (st *directRun) commitCard() string {
 	if cerr != nil {
 		return "card_commit 失败: " + cerr.Error()
 	}
-	st.finalParts = append(st.finalParts, core.Part{Type: core.PartCard, Card: &core.CardPart{Kind: string(core.CardKindResult), CardID: card.ID}})
-	st.explicitCard = true
+	st.appendFinalPart(core.Part{Type: core.PartCard, Card: &core.CardPart{Kind: string(core.CardKindResult), CardID: card.ID}})
+	st.markExplicitCard()
 	return fmt.Sprintf("已作为卡片发出（%s，card:%s）。对话中保留简短结论即可，不要重复卡片全文。", card.Title, card.ID)
 }
 
 func (st *directRun) pinSubagentArtifacts(text string) {
+	st.toolMu.Lock()
 	seen := map[string]bool{}
 	for _, ref := range st.deliverables {
 		if ref != nil {
 			seen[ref.ArtifactID] = true
 		}
 	}
+	st.toolMu.Unlock()
+	pinned := make([]*core.ArtifactRef, 0, 4)
 	for _, id := range gates.ArtifactIDPattern.FindAllString(text, -1) {
 		if seen[id] {
 			continue
@@ -1332,8 +1396,14 @@ func (st *directRun) pinSubagentArtifacts(text string) {
 			continue
 		}
 		seen[id] = true
-		st.deliverables = append(st.deliverables, &core.ArtifactRef{ArtifactID: art.ID, Name: art.Name, Kind: art.Kind})
+		pinned = append(pinned, &core.ArtifactRef{ArtifactID: art.ID, Name: art.Name, Kind: art.Kind})
 	}
+	if len(pinned) == 0 {
+		return
+	}
+	st.toolMu.Lock()
+	st.deliverables = append(st.deliverables, pinned...)
+	st.toolMu.Unlock()
 }
 
 func errString(err error) string {

internal/runtime/llm_test.go

@@ -27,6 +27,7 @@ type fakeRunCtx struct {
 	cardflow            bool
 	events              []emittedEvent
 	eventsMu            sync.Mutex
+	stateMu             sync.Mutex // 并行工具执行下会写回的假状态（计数/卡片/用量/后台）
 	assistant           []core.Part
 	cards               []core.ActivityCard
 	streamCardID        core.ID // 活跃流式卡（Begin/Append/Commit fake 语义）
@@ -80,8 +81,15 @@ func (f *fakeRunCtx) emittedEvents() []emittedEvent {
 	defer f.eventsMu.Unlock()
 	return append([]emittedEvent(nil), f.events...)
 }
-func (f *fakeRunCtx) SetAssistantParts(parts []core.Part) error { f.assistant = parts; return nil }
+func (f *fakeRunCtx) SetAssistantParts(parts []core.Part) error {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
+	f.assistant = parts
+	return nil
+}
 func (f *fakeRunCtx) AddUsage(u core.Usage) {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
 	f.usageTotal.PromptTokens += u.PromptTokens
 	f.usageTotal.CompletionTokens += u.CompletionTokens
 	f.usageTotal.TotalTokens += u.TotalTokens
@@ -113,6 +121,8 @@ func (f *fakeRunCtx) WriteArtifact(name, kind, mime string, content []byte) (cor
 }
 func (f *fakeRunCtx) Retrieve(q core.RetrievalQuery) ([]core.RetrievalHit, error) { return nil, nil }
 func (f *fakeRunCtx) ExecuteTool(call core.ToolCallRequest) core.ToolCallResult {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
 	f.toolRuns++
 	res := core.ToolCallResult{Status: "ok", Output: "done", Truncated: f.execTruncated}
 	if f.execStatus != "" {
@@ -133,6 +143,8 @@ func (f *fakeRunCtx) History() []core.Message {
 	return []core.Message{{ID: "m1", Role: core.RoleUser, Parts: []core.Part{{Type: core.PartText, Text: "hi"}}}}
 }
 func (f *fakeRunCtx) SpawnBackground(agentID, name, task, hint string) (core.ID, error) {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
 	f.bgCalls++
 	if f.bgErr != nil {
 		return "", f.bgErr
@@ -174,6 +186,14 @@ func (f *fakeRunCtx) Attachments() []core.ParsedDocument { return f.attachments
 func (f *fakeRunCtx) Tools() []core.ToolDesc             { return nil }
 func (f *fakeRunCtx) Subtask() string                    { return "" }
 func (f *fakeRunCtx) CreateCard(card core.ActivityCard) (core.ActivityCard, error) {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
+	return f.createCardLocked(card)
+}
+
+// createCardLocked 建卡（调用方须持有 stateMu）；卡片工具与工件门面卡
+// 可能从并行工具 goroutine 同时进来。
+func (f *fakeRunCtx) createCardLocked(card core.ActivityCard) (core.ActivityCard, error) {
 	card.ID = core.ID(fmt.Sprintf("card_%d", len(f.cards)+1))
 	f.cards = append(f.cards, card)
 	return card, nil
@@ -199,7 +219,9 @@ func (f *fakeRunCtx) SubmitCard(card core.ActivityCard) (core.ActivityCard, erro
 // runmgr/cardsvc 语义，供工具编排层断言。
 func (f *fakeRunCtx) BeginStreamCard(card core.ActivityCard) (core.ActivityCard, error) {
 	card.Status = core.CardActive
-	created, err := f.CreateCard(card)
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
+	created, err := f.createCardLocked(card)
 	if err != nil {
 		return created, err
 	}
@@ -208,6 +230,8 @@ func (f *fakeRunCtx) BeginStreamCard(card core.ActivityCard) (core.ActivityCard,
 }
 
 func (f *fakeRunCtx) AppendStreamCard(text string) error {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
 	if f.streamCardID == "" {
 		return errors.New("card: no active stream card (card_begin first)")
 	}
@@ -226,6 +250,8 @@ func (f *fakeRunCtx) AppendStreamCard(text string) error {
 }
 
 func (f *fakeRunCtx) CommitStreamCard() (core.ActivityCard, error) {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
 	if f.streamCardID == "" {
 		return core.ActivityCard{}, errors.New("card: no active stream card (card_begin first)")
 	}
@@ -240,6 +266,8 @@ func (f *fakeRunCtx) CommitStreamCard() (core.ActivityCard, error) {
 	return core.ActivityCard{}, errors.New("card: not found")
 }
 func (f *fakeRunCtx) Card(id string) *core.ActivityCard {
+	f.stateMu.Lock()
+	defer f.stateMu.Unlock()
 	for i := range f.cards {
 		if string(f.cards[i].ID) == id {
 			return &f.cards[i]

internal/runtime/model_test.go

@@ -90,3 +90,134 @@ func TestResolveVisionModel(t *testing.T) {
 		t.Fatalf("text fallbacks %#v", fb)
 	}
 }
+
+// 只有 Settings 端口的宿主：快照可取，没有就报缺失（调用方自己决定回落）。
+type settingsOnlyCtx struct{ eff core.EffectiveSettings }
+
+func (c settingsOnlyCtx) Settings() core.EffectiveSettings { return c.eff }
+
+// 只有 Run 端口的宿主：属主只能来自 run。
+type runOnlyCtx struct{ owner string }
+
+func (c runOnlyCtx) Run() core.Run { return core.Run{ID: "run_t", Owner: core.ID(c.owner)} }
+
+// 两个端口都有的宿主（runmgr 的 runCtx 形态）。
+type runProfileCtx struct {
+	settingsOnlyCtx
+	runOnlyCtx
+	prof core.AgentProfile
+}
+
+func (c runProfileCtx) Profile() core.AgentProfile { return c.prof }
+
+func TestRunEffectiveSettingsNeedsHostPort(t *testing.T) {
+	eff := effOf(map[string]any{"models": map[string]any{"chat": map[string]any{"model": "m"}}})
+	if got, ok := RunEffectiveSettings(settingsOnlyCtx{eff: eff}); !ok || got.GetString("models.chat.model", "") != "m" {
+		t.Fatalf("run snapshot = %+v ok=%v, want the host snapshot", got, ok)
+	}
+	if _, ok := RunEffectiveSettings(settingsOnlyCtx{}); ok {
+		t.Fatal("empty snapshot must be reported as missing so the caller can fall back")
+	}
+	if _, ok := RunEffectiveSettings(runOnlyCtx{owner: "alice"}); ok {
+		t.Fatal("host without a Settings port must not be reported as having one")
+	}
+}
+
+func TestRunProfileNeverFallsBackToDefaultOwner(t *testing.T) {
+	prof := core.AgentProfile{Owner: "alice", Model: core.ModelRoute{Chat: "alice-model"}}
+	both := runProfileCtx{settingsOnlyCtx: settingsOnlyCtx{}, runOnlyCtx: runOnlyCtx{owner: "alice"}, prof: prof}
+	if got := RunProfile(both); got.Owner != "alice" || got.Model.Chat != "alice-model" {
+		t.Fatalf("profile port must win: %+v", got)
+	}
+	if got := RunProfile(both).Owner; got != "alice" {
+		t.Fatalf("owner = %q, want alice", got)
+	}
+	// 画像端口缺席（或没带 Owner）时取 run.Owner——密钥层归属不能退化成默认账号。
+	bare := runProfileCtx{settingsOnlyCtx: settingsOnlyCtx{}, runOnlyCtx: runOnlyCtx{owner: "bob"}}
+	if got := RunProfile(bare).Owner; got != "bob" {
+		t.Fatalf("owner = %q, want the run owner bob", got)
+	}
+	if got := RunProfile(runProfileCtx{settingsOnlyCtx: settingsOnlyCtx{}, runOnlyCtx: runOnlyCtx{owner: "bob"}, prof: core.AgentProfile{}}).Owner; got != "bob" {
+		t.Fatalf("empty profile owner = %q, want the run owner bob", got)
+	}
+	if got := RunProfile(runOnlyCtx{}).Owner; got != "" {
+		t.Fatalf("owner without any port = %q, want empty", got)
+	}
+}
+
+// 带自定义快照的运行上下文（其余端口由 fakeRunCtx 满足）。
+type runSnapCtx struct {
+	*fakeRunCtx
+	eff core.EffectiveSettings
+}
+
+func (c *runSnapCtx) Settings() core.EffectiveSettings { return c.eff }
+
+// 运行内解析主路由：快照 + 画像覆盖 + 属主密钥层，与直连同一条规则。
+func TestRunChatRouteUsesRunSnapshotAndOwnerKey(t *testing.T) {
+	saved := SecretLookup
+	defer func() { SecretLookup = saved }()
+	secrets := map[string]string{"alice": "sk-alice-synthetic", "bob": "sk-bob-synthetic"}
+	SecretLookup = func(owner, _ string) (string, string, bool) {
+		if owner == "" {
+			owner = "local"
+		}
+		v, ok := secrets[owner]
+		return v, "owner", ok
+	}
+	eff := effOf(map[string]any{"models": map[string]any{"chat": map[string]any{
+		"model": "settings-model", "baseUrl": "https://shared.example/v1", "apiKey": "sk-settings-synthetic",
+	}}})
+	for _, owner := range []string{"alice", "bob"} {
+		rc := &runSnapCtx{fakeRunCtx: &fakeRunCtx{prof: core.AgentProfile{Owner: owner, Model: core.ModelRoute{Chat: owner + "-profile-model"}}}, eff: eff}
+		got := RunChatRoute(rc)
+		want := ResolveChatModel(rc.Profile(), rc.Settings())
+		if got != want {
+			t.Fatalf("%s: run route %+v != direct rule %+v", owner, got, want)
+		}
+		if got.Model != owner+"-profile-model" || got.Base != "https://shared.example/v1" {
+			t.Fatalf("%s: route = %+v, want the profile model on the shared endpoint", owner, got)
+		}
+		if got.Key != "sk-"+owner+"-synthetic" || got.KeySource != "owner" {
+			t.Fatalf("%s: key = %q (%s), want that owner's own secret", owner, got.Key, got.KeySource)
+		}
+	}
+}
+
+// 客户端构造：reasoning split 与受限 EOF 契约都只看本路由自己的 model+base，
+// 画像覆盖后的路由重新判定（与直连路径同一个构造器）。
+func TestOpenRouteClientDecidesPerRoute(t *testing.T) {
+	const base = "https://api.example.com/v1"
+	contract := routeEOFMatching(routeEOFModel, base)
+	eff := routeEOFEff(map[string]any{"model": routeEOFModel, "baseUrl": base, "apiKey": "k"}, contract)
+
+	route := ResolvedModel{Kind: "chat", Model: routeEOFModel, Base: base, Key: "k"}
+	client := OpenRouteClient(route, eff)
+	if client.BaseURL != base || client.APIKey != "k" {
+		t.Fatalf("client route = %q/%q, want %q/k", client.BaseURL, client.APIKey, base)
+	}
+	if client.ReasoningSplit {
+		t.Fatal("non-MiniMax model must not enable reasoning split")
+	}
+	if client.RouteContract == nil {
+		t.Fatal("matching configuration must attach the contract")
+	}
+	// 画像覆盖改的是模型名：分流与契约都按覆盖后的路由重新判定。
+	for _, tc := range []struct {
+		model       string
+		wantSplit   bool
+		wantEOfRule bool
+	}{
+		{"MiniMax-M2", true, false},
+		{routeEOFModel, false, true},
+		{"other-model", false, false},
+	} {
+		prof := core.AgentProfile{Owner: "alice", Model: core.ModelRoute{Chat: tc.model}}
+		overridden := ResolveChatModel(prof, eff)
+		got := OpenRouteClient(overridden, eff)
+		if got.ReasoningSplit != tc.wantSplit || (got.RouteContract != nil) != tc.wantEOfRule {
+			t.Fatalf("profile model %q: split=%v contract=%v, want split=%v contract=%v",
+				tc.model, got.ReasoningSplit, got.RouteContract != nil, tc.wantSplit, tc.wantEOfRule)
+		}
+	}
+}

internal/runtime/route_contract_eof_test.go

@@ -41,7 +41,7 @@ func routeEOFMatching(model, base string) map[string]any {
 
 func TestRouteContractDefaultOff(t *testing.T) {
 	route := ResolvedModel{Kind: "chat", Model: routeEOFModel, Base: "https://api.example.com/v1", Key: "k"}
-	if c := openRouteClient(route, core.EffectiveSettings{}); c.RouteContract != nil {
+	if c := OpenRouteClient(route, core.EffectiveSettings{}); c.RouteContract != nil {
 		t.Fatalf("no settings must leave RouteContract nil, got %+v", c.RouteContract)
 	}
 	full := routeEOFMatching(routeEOFModel, "https://api.example.com/v1")
@@ -206,7 +206,7 @@ func routeEOFHTTPClient(t *testing.T, server *httptest.Server) *http.Client {
 
 func routeEOFClient(t *testing.T, server *httptest.Server, route ResolvedModel, eff core.EffectiveSettings) *agentllm.Client {
 	t.Helper()
-	c := openRouteClient(route, eff)
+	c := OpenRouteClient(route, eff)
 	c.HTTPClient = routeEOFHTTPClient(t, server)
 	return c
 }
@@ -373,3 +373,65 @@ func TestRouteContractEOFReleasesOneToolCallInLoop(t *testing.T) {
 		}
 	})
 }
+
+// 小队路径的路由来自同一份运行快照：契约对得上的路由与直连一样放行一次
+// 工具调用；画像把模型名改掉之后，契约不再跟随，放行也一并消失。
+func TestRouteContractEOFForRunScopedRoute(t *testing.T) {
+	var requests atomic.Int32
+	server := routeEOFServer(t, &requests)
+	base := server.URL + "/v1"
+	models := map[string]any{
+		"chat":             map[string]any{"model": routeEOFModel, "baseUrl": base, "apiKey": "k"},
+		"routeContractEOF": routeEOFMatching(routeEOFModel, base),
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+	decls := []agentllm.ToolDecl{{Name: routeEOFTool, Description: "report", Parameters: routeEOFParams}}
+
+	run := func(t *testing.T, prof core.AgentProfile) (*agentllm.Client, []agentllm.Event) {
+		t.Helper()
+		rc := &runSnapCtx{
+			fakeRunCtx: &fakeRunCtx{ctx: ctx, prof: prof},
+			eff:        core.EffectiveSettings{"models": models},
+		}
+		route := RunChatRoute(rc)
+		client := routeEOFClient(t, server, route, rc.Settings())
+		stream := GuardProjectStream(rc, "", annotateKeyFailure(client.Stream, route))
+		var terminal []agentllm.Event
+		for ev := range stream(ctx, route.Model, []agentllm.Message{{Role: agentllm.RoleUser, Content: "hi"}}, decls, agentllm.StreamOptions{}) {
+			if ev.Kind == agentllm.KindMessageEnd || ev.Kind == agentllm.KindError {
+				terminal = append(terminal, ev)
+			}
+		}
+		return client, terminal
+	}
+
+	t.Run("route matching the configuration releases one call", func(t *testing.T) {
+		client, terminal := run(t, core.AgentProfile{Owner: "alice"})
+		if client.RouteContract == nil {
+			t.Fatal("run-scoped route must carry the contract, as on the direct path")
+		}
+		if len(terminal) != 1 || terminal[0].Kind != agentllm.KindMessageEnd || terminal[0].Err != nil {
+			t.Fatalf("terminal events = %+v, want one clean message_end", terminal)
+		}
+		if len(terminal[0].Message.ToolCalls) != 1 || terminal[0].Message.ToolCalls[0].Name != routeEOFTool {
+			t.Fatalf("released calls = %+v, want exactly one %s", terminal[0].Message.ToolCalls, routeEOFTool)
+		}
+		if terminal[0].CompletionBasis != agentllm.CompletionRouteContractEOF {
+			t.Fatalf("completion basis = %q, want %q", terminal[0].CompletionBasis, agentllm.CompletionRouteContractEOF)
+		}
+	})
+
+	t.Run("profile override drops the contract and the release", func(t *testing.T) {
+		client, terminal := run(t, core.AgentProfile{Owner: "alice", Model: core.ModelRoute{Chat: "profile-model"}})
+		if client.RouteContract != nil {
+			t.Fatalf("overridden route kept the contract: %+v", client.RouteContract)
+		}
+		if len(terminal) != 1 || terminal[0].Err == nil || !strings.Contains(terminal[0].Err.Error(), routeEOFRejection) {
+			t.Fatalf("terminal events = %+v, want the %q rejection", terminal, routeEOFRejection)
+		}
+		if len(terminal[0].Message.ToolCalls) != 0 {
+			t.Fatalf("tool call released without the contract: %+v", terminal[0].Message.ToolCalls)
+		}
+	})
+}

internal/runtime/run_config.go

@@ -0,0 +1,62 @@
+package runtime
+
+import (
+	"strings"
+
+	agentllm "agent-native/runtime/llm"
+	core "agent-system-core"
+)
+
+// 运行配置解析的窄端口。直连 RunCtx 与小队 squadadapter.Ctx 共用同一组
+// 可选接口：任一执行面都能从「本次运行」拿到同一份生效快照，绝不按默认账号
+// 另起一套解析（KTD3）。
+
+type runSettingsPort interface{ Settings() core.EffectiveSettings }
+type runProfilePort interface{ Profile() core.AgentProfile }
+type runScopePort interface{ Run() core.Run }
+
+// RunEffectiveSettings 返回本次运行生效的配置快照（Settings 端口已由宿主按
+// run.Owner + run.ProjectID 合并 defaults→system→user→project）。
+// ok=false 表示宿主没有该端口或快照为空；调用方自行决定回落策略，
+// 不得在有快照时回落到别的属主。
+func RunEffectiveSettings(rc any) (core.EffectiveSettings, bool) {
+	port, ok := rc.(runSettingsPort)
+	if !ok {
+		return nil, false
+	}
+	eff := port.Settings()
+	if len(eff) == 0 {
+		return nil, false
+	}
+	return eff, true
+}
+
+// RunProfile 返回本次运行的画像：宿主实现 Profile 端口时直接取；否则按
+// run.Owner 合成零值画像——Owner 决定密钥层归属（overlayKey），缺失时
+// 绝不能退化成默认账号，否则会用别人的密钥。
+func RunProfile(rc any) core.AgentProfile {
+	var prof core.AgentProfile
+	if port, ok := rc.(runProfilePort); ok {
+		prof = port.Profile()
+	}
+	if strings.TrimSpace(prof.Owner) == "" {
+		if scope, ok := rc.(runScopePort); ok {
+			prof.Owner = scope.Run().Owner
+		}
+	}
+	return prof
+}
+
+// RunChatRoute 解析本次运行的主对话路由（画像 ModelRoute > 当前用户/项目设置层）。
+// SquadRunner 用它给小队入口定模型，使小队与直连共用同一条解析规则。
+func RunChatRoute(rc RunCtx) ResolvedModel { return ResolveChatModel(rc.Profile(), rc.Settings()) }
+
+// OpenRouteClient 按一次解析出的路由构造 OpenAI 兼容客户端：端点与密钥取自
+// 本路由自己的解析结果，MiniMax 系模型的 reasoning split 与受限 EOF route
+// contract 都只看本路由的 model+base。直连、小队与其他执行面必须共用它，
+// 避免同一个 run 里出现两套 per-route 规则（分流的思考、EOF 放行会不一致）。
+func OpenRouteClient(route ResolvedModel, eff core.EffectiveSettings) *agentllm.Client {
+	c := openLLMClient(route.Base, route.Key, route.Model)
+	c.RouteContract = routeContractFor(eff, route)
+	return c
+}

internal/runtime/squad_events.go

@@ -0,0 +1,188 @@
+package runtime
+
+import (
+	"strings"
+	"sync"
+
+	"agent-squad/squad"
+	core "agent-system-core"
+)
+
+// toolResultSummaryLen 是工具结果摘要的截断长度（与既有展示一致）。
+const toolResultSummaryLen = 160
+
+// toolEventID 是宿主侧的工具调用身份：优先用上游 CallID（并行同名工具据此配对，
+// 而不是按到达顺序）；空串 = legacy/未知，退回工具名，保持既有展示不变。
+func toolEventID(ev squad.ProcessEvent) string {
+	if id := strings.TrimSpace(ev.CallID); id != "" {
+		return id
+	}
+	return ev.Tool
+}
+
+// toolEventOutcome 把上游 tool_execution_end 翻译成宿主展示的真实结局。
+//
+// 取值域与上游一致（ok | error | denied | canceled），不新增、不改写上游状态：
+//   - Status 非空：原样透传；
+//   - Status 为空且没有失败信号（ErrorReason 也空）：legacy/未知，沿用旧的 "ok"
+//     与 Detail 摘要（字节一致，不臆造结局）；
+//   - Status 为空但有 ErrorReason：有失败信号而状态未知，报 error 而不是 ok；
+//   - 非 ok 时摘要取 ErrorReason 原文（截断），上游没给原因才回退 Detail。
+func toolEventOutcome(ev squad.ProcessEvent) (status, summary string) {
+	status = strings.TrimSpace(ev.Status)
+	if status == "" {
+		if strings.TrimSpace(ev.ErrorReason) == "" {
+			return squad.ToolStatusOK, truncateRun(ev.Detail, toolResultSummaryLen)
+		}
+		status = squad.ToolStatusError
+	}
+	if status == squad.ToolStatusOK {
+		return status, truncateRun(ev.Detail, toolResultSummaryLen)
+	}
+	if strings.TrimSpace(ev.ErrorReason) != "" {
+		return status, truncateRun(ev.ErrorReason, toolResultSummaryLen)
+	}
+	return status, truncateRun(ev.Detail, toolResultSummaryLen)
+}
+
+// toolFailure 是一次未被恢复的工具失败（用于终局文本一致性检查，不覆盖工具部件）。
+type toolFailure struct {
+	Tool    string
+	CallID  string
+	Status  string
+	Summary string
+}
+
+// squadEventLog 是小队过程帧在宿主侧的聚合点。
+//
+// 并行工具调用会从多个 goroutine 回调进来（内核 executeParallel 逐个派发），
+// 因此流式文本、工具部件、用量与 pending 配对表全部在同一把锁下更新：
+// 既不丢条目，也不会把 A 调用的 start 与 B 调用的 end 交错写坏。
+// 事件发射与部件追加在同一临界区内，保持到达顺序与最终部件顺序一致。
+type squadEventLog struct {
+	rc RunCtx
+
+	mu       sync.Mutex
+	streamed strings.Builder
+	textIdx  int
+	parts    []core.Part
+	pending  map[string]string // callID → 工具名（start/end 配对）
+	failure  *toolFailure      // 最近一次失败；同名工具后续再起即视为已恢复
+}
+
+// newSquadEventLog 绑定一次运行的过程帧回调。
+func newSquadEventLog(rc RunCtx) *squadEventLog {
+	return &squadEventLog{rc: rc, pending: map[string]string{}}
+}
+
+// onEvent 是小队过程帧回调（并发安全）。
+func (l *squadEventLog) onEvent(ev squad.ProcessEvent) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	switch ev.Type {
+	case "text_delta":
+		if ev.Text == "" {
+			return
+		}
+		l.streamed.WriteString(ev.Text)
+		_ = l.rc.Emit(core.EvMessageDelta, core.MessageDeltaPayload{Index: l.textIdx, Text: ev.Text})
+	case "reasoning_delta":
+		if ev.Text != "" {
+			_ = l.rc.Emit(core.EvThinkingDelta, core.ThinkingDeltaPayload{Text: ev.Text})
+		}
+	case "tool_execution_start":
+		id := toolEventID(ev)
+		if id != "" {
+			l.pending[id] = ev.Tool
+		}
+		l.noteRecovered(ev.Tool)
+		_ = l.rc.Emit(core.EvToolCall, core.ToolCallPayload{CallID: id, Name: ev.Tool, Arguments: ev.Detail})
+		l.parts = append(l.parts, core.Part{Type: core.PartToolCall, Process: true, ToolCall: &core.ToolCallPart{ID: id, Name: ev.Tool, Arguments: ev.Detail}})
+	case "tool_execution_end":
+		id := toolEventID(ev)
+		if tool, ok := l.pending[id]; ok && ev.Tool == "" {
+			ev.Tool = tool
+		}
+		delete(l.pending, id)
+		status, summary := toolEventOutcome(ev)
+		// 发射与部件同源：前端过程行与落库部件说的是同一件事。
+		_ = l.rc.Emit(core.EvToolResult, core.ToolResultPayload{CallID: id, Status: status, Summary: summary})
+		l.parts = append(l.parts, core.Part{Type: core.PartToolResult, Process: true, ToolResult: &core.ToolResultPart{CallID: id, Status: status, Summary: summary}})
+		if status == squad.ToolStatusOK {
+			l.noteRecovered(ev.Tool)
+		} else {
+			l.failure = &toolFailure{Tool: ev.Tool, CallID: id, Status: status, Summary: summary}
+		}
+	case "usage":
+		if sink, ok := l.rc.(interface{ AddUsage(core.Usage) }); ok {
+			sink.AddUsage(core.Usage{
+				PromptTokens: ev.PromptTokens, CompletionTokens: ev.CompletionTokens, TotalTokens: ev.PromptTokens + ev.CompletionTokens,
+				LastPromptTokens: ev.LastPromptTokens, LastCompletionTokens: ev.LastCompletionTokens,
+				CacheReadTokens: ev.CacheReadTokens, CacheWriteTokens: ev.CacheWriteTokens,
+			})
+		}
+	}
+}
+
+// noteRecovered 把同名工具的后续进展（再次发起或调用成功）记为已恢复：
+// 失败部件仍留在过程部件里，只是不再让收尾文本替它宣布成功。
+func (l *squadEventLog) noteRecovered(tool string) {
+	if l.failure != nil && l.failure.Tool == tool {
+		l.failure = nil
+	}
+}
+
+// reply 是本次运行聚合到的模型文本（不含任何宿主补写）。
+func (l *squadEventLog) reply() string {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.streamed.String()
+}
+
+// parts 返回过程部件的快照（复制，避免把内部切片交给最终部件）。
+func (l *squadEventLog) toolParts() []core.Part {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return append([]core.Part(nil), l.parts...)
+}
+
+// unresolvedFailure 返回终局时仍未恢复的工具失败，没有则 nil。
+func (l *squadEventLog) unresolvedFailure() *toolFailure {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.failure == nil {
+		return nil
+	}
+	f := *l.failure
+	return &f
+}
+
+// finalReply 决定终局文本。模型文本原样保留（不代写、不改写）；只有宿主兜底的
+// 「已完成。」在仍有未恢复的工具失败时会被换成如实说明，避免收尾文本与失败部件
+// 自相矛盾。legacy 事件（无 CallID/Status）走不到这里，展示与旧行为一致。
+func (l *squadEventLog) finalReply(modelText, summary, fallback string) string {
+	reply := strings.TrimSpace(modelText)
+	if reply == "" {
+		reply = strings.TrimSpace(summary)
+	}
+	if reply != "" {
+		return reply
+	}
+	if f := l.unresolvedFailure(); f != nil {
+		return failedToolLine(f)
+	}
+	return fallback
+}
+
+// failedToolLine 如实描述未恢复的工具失败，不声称成功，也不编造原因。
+func failedToolLine(f *toolFailure) string {
+	name := strings.TrimSpace(f.Tool)
+	if name == "" {
+		name = "工具"
+	}
+	reason := strings.TrimSpace(f.Summary)
+	if reason == "" {
+		return name + " 未完成（" + f.Status + "）"
+	}
+	return name + " 未完成（" + f.Status + "）：" + reason
+}

internal/runtime/squad_events_test.go

@@ -0,0 +1,443 @@
+package runtime
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"sync"
+	"testing"
+
+	agentllm "agent-native/runtime/llm"
+	"agent-squad/squad"
+	core "agent-system-core"
+)
+
+// eventProbe 记录小队过程帧回调发射出去的事件（顺序与内容都要能断言）。
+// Emit 由 squadEventLog 的临界区内调用，因此这里无需再自锁。
+type eventProbe struct {
+	*entryFake
+	rec      *squadEventLog
+	toolCall []core.ToolCallPayload
+	result   []core.ToolResultPayload
+}
+
+func newEventProbe() *eventProbe {
+	p := &eventProbe{entryFake: &entryFake{}}
+	p.rec = newSquadEventLog(p)
+	return p
+}
+
+func (p *eventProbe) Emit(typ core.StreamEventType, payload any) error {
+	switch v := payload.(type) {
+	case core.ToolCallPayload:
+		p.toolCall = append(p.toolCall, v)
+	case core.ToolResultPayload:
+		p.result = append(p.result, v)
+	}
+	return p.entryFake.Emit(typ, payload)
+}
+
+func (p *eventProbe) onEvent(ev squad.ProcessEvent) { p.rec.onEvent(ev) }
+
+func (p *eventProbe) parts() []core.Part { return p.rec.toolParts() }
+
+func (p *eventProbe) calls() []core.ToolCallPayload {
+	return append([]core.ToolCallPayload(nil), p.toolCall...)
+}
+
+func (p *eventProbe) results() []core.ToolResultPayload {
+	return append([]core.ToolResultPayload(nil), p.result...)
+}
+
+func toolCallsOf(parts []core.Part) []core.ToolCallPart {
+	var out []core.ToolCallPart
+	for _, p := range parts {
+		if p.ToolCall != nil {
+			out = append(out, *p.ToolCall)
+		}
+	}
+	return out
+}
+
+func toolResultsOf(parts []core.Part) []core.ToolResultPart {
+	var out []core.ToolResultPart
+	for _, p := range parts {
+		if p.ToolResult != nil {
+			out = append(out, *p.ToolResult)
+		}
+	}
+	return out
+}
+
+// TestSquadEventsPairByCallID：两个同名工具的 start/end 必须按 CallID 配对，
+// 不得因名字相同而互相对调（这是并行同名工具显示错乱的根因）。
+func TestSquadEventsPairByCallID(t *testing.T) {
+	p := newEventProbe()
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: "grep", CallID: "call_a", Detail: `{"q":"a"}`})
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: "grep", CallID: "call_b", Detail: `{"q":"b"}`})
+	// 交错到达：B 先结束。
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", CallID: "call_b", Status: squad.ToolStatusOK, Detail: "命中 B"})
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", CallID: "call_a", Status: squad.ToolStatusError, ErrorReason: "路径不存在"})
+
+	parts := p.parts()
+	calls := toolCallsOf(parts)
+	if len(calls) != 2 || calls[0].ID != "call_a" || calls[1].ID != "call_b" {
+		t.Fatalf("tool call parts = %+v", calls)
+	}
+	emittedCalls := p.calls()
+	if len(emittedCalls) != 2 || emittedCalls[0].CallID != "call_a" || emittedCalls[1].CallID != "call_b" {
+		t.Fatalf("emitted tool calls = %+v", emittedCalls)
+	}
+	results := toolResultsOf(parts)
+	if len(results) != 2 {
+		t.Fatalf("tool result parts = %+v", results)
+	}
+	if results[0].CallID != "call_b" || results[0].Status != squad.ToolStatusOK || results[0].Summary != "命中 B" {
+		t.Fatalf("result B = %+v", results[0])
+	}
+	if results[1].CallID != "call_a" || results[1].Status != squad.ToolStatusError || results[1].Summary != "路径不存在" {
+		t.Fatalf("result A = %+v", results[1])
+	}
+	if p.rec.unresolvedFailure() == nil || p.rec.unresolvedFailure().CallID != "call_a" {
+		t.Fatalf("unresolved failure = %+v", p.rec.unresolvedFailure())
+	}
+}
+
+// TestSquadEventsStatusIsTruthful：失败/取消/拒绝必须原样透传，不得一律报 ok，
+// 摘要取真实原因（截断），部件与发射载荷完全一致。
+func TestSquadEventsStatusIsTruthful(t *testing.T) {
+	long := strings.Repeat("失败原因", 80)
+	cases := []struct {
+		name    string
+		ev      squad.ProcessEvent
+		status  string
+		summary string
+	}{
+		{"error", squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", CallID: "c1",
+			Status: squad.ToolStatusError, ErrorReason: "权限不足", Detail: "旧摘要"}, squad.ToolStatusError, "权限不足"},
+		{"denied", squad.ProcessEvent{Type: "tool_execution_end", Tool: "run_command", CallID: "c2",
+			Status: squad.ToolStatusDenied, ErrorReason: "策略拒绝执行"}, squad.ToolStatusDenied, "策略拒绝执行"},
+		{"canceled", squad.ProcessEvent{Type: "tool_execution_end", Tool: "web_search", CallID: "c3",
+			Status: squad.ToolStatusCanceled, ErrorReason: "用户取消"}, squad.ToolStatusCanceled, "用户取消"},
+		{"ok", squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", CallID: "c4",
+			Status: squad.ToolStatusOK, Detail: "命中 3 处"}, squad.ToolStatusOK, "命中 3 处"},
+		// 有失败信号但状态未知：不得报 ok。
+		{"status-less error signal", squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", CallID: "c5",
+			ErrorReason: "连接被拒绝", Detail: "旧摘要"}, squad.ToolStatusError, "连接被拒绝"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			status, summary := toolEventOutcome(tc.ev)
+			if status != tc.status || summary != tc.summary {
+				t.Fatalf("outcome = %q/%q, want %q/%q", status, summary, tc.status, tc.summary)
+			}
+			p := newEventProbe()
+			p.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: tc.ev.Tool, CallID: tc.ev.CallID})
+			p.onEvent(tc.ev)
+			got := toolResultsOf(p.parts())
+			if len(got) != 1 {
+				t.Fatalf("parts = %+v", p.parts())
+			}
+			// 落库部件与发射载荷同源。
+			if got[0].Status != tc.status || got[0].Summary != tc.summary || got[0].CallID != tc.ev.CallID {
+				t.Fatalf("result part = %+v", got[0])
+			}
+			wantPayload := core.ToolResultPayload{CallID: tc.ev.CallID, Status: tc.status, Summary: tc.summary}
+			if gotPayloads := p.results(); len(gotPayloads) != 1 || gotPayloads[0] != wantPayload {
+				t.Fatalf("emitted payload = %+v", gotPayloads)
+			}
+			if gotCalls := p.calls(); len(gotCalls) != 1 || gotCalls[0].CallID != tc.ev.CallID || gotCalls[0].Name != tc.ev.Tool {
+				t.Fatalf("emitted tool call = %+v", gotCalls)
+			}
+		})
+	}
+	t.Run("summary truncated", func(t *testing.T) {
+		status, summary := toolEventOutcome(squad.ProcessEvent{Status: squad.ToolStatusError, ErrorReason: long})
+		if status != squad.ToolStatusError {
+			t.Fatalf("status = %q", status)
+		}
+		if want := truncateRun(long, toolResultSummaryLen); summary != want {
+			t.Fatalf("summary = %q, want truncated %q", summary, want)
+		}
+	})
+}
+
+// TestSquadEventsLegacyFramesUnchanged：字段全空的 legacy 事件必须与旧行为字节一致
+// （按工具名配对、状态恒为 ok、摘要取 Detail）。
+func TestSquadEventsLegacyFramesUnchanged(t *testing.T) {
+	p := newEventProbe()
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: "grep", Detail: `{"q":"x"}`})
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", Detail: strings.Repeat("d", 200)})
+	p.onEvent(squad.ProcessEvent{Type: "text_delta", Text: "结论"})
+	p.onEvent(squad.ProcessEvent{Type: "usage", PromptTokens: 3, CompletionTokens: 1, LastPromptTokens: 2, CacheReadTokens: 1})
+
+	parts := p.parts()
+	calls := toolCallsOf(parts)
+	if len(calls) != 1 {
+		t.Fatalf("calls = %+v", calls)
+	}
+	wantCall := core.ToolCallPart{ID: "grep", Name: "grep", Arguments: `{"q":"x"}`}
+	if calls[0] != wantCall {
+		t.Fatalf("call part = %+v, want %+v", calls[0], wantCall)
+	}
+	results := toolResultsOf(parts)
+	wantResult := core.ToolResultPart{CallID: "grep", Status: "ok", Summary: truncateRun(strings.Repeat("d", 200), 160)}
+	if len(results) != 1 || results[0] != wantResult {
+		t.Fatalf("result part = %+v, want %+v", results, wantResult)
+	}
+	emitted := p.results()
+	if len(emitted) != 1 || emitted[0].CallID != "grep" || emitted[0].Status != "ok" ||
+		emitted[0].Summary != truncateRun(strings.Repeat("d", 200), 160) {
+		t.Fatalf("emitted = %+v", emitted)
+	}
+	if p.rec.reply() != "结论" {
+		t.Fatalf("reply = %q", p.rec.reply())
+	}
+	if f := p.rec.unresolvedFailure(); f != nil {
+		t.Fatalf("legacy frames must not register a failure: %+v", f)
+	}
+	if p.rec.finalReply("", "", "已完成。") != "已完成。" {
+		t.Fatalf("legacy fallback text changed: %q", p.rec.finalReply("", "", "已完成。"))
+	}
+}
+
+// TestSquadEventsConcurrentCallbacksKeepEveryEntry：并行回调（-race）下不得丢条目、
+// 不得串字段；每次调用自己的 start/end 仍成对。
+func TestSquadEventsConcurrentCallbacksKeepEveryEntry(t *testing.T) {
+	const calls = 64
+	p := newEventProbe()
+	wantStatus := map[string]string{}
+	var wg sync.WaitGroup
+	for i := 0; i < calls; i++ {
+		id := fmt.Sprintf("call_%02d", i)
+		wantStatus[id] = squad.ToolStatusOK
+		failing := i%8 == 0
+		if failing {
+			wantStatus[id] = squad.ToolStatusError
+		}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			p.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: "grep", CallID: id, Detail: id})
+			if failing {
+				p.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", CallID: id,
+					Status: squad.ToolStatusError, ErrorReason: "boom " + id})
+				return
+			}
+			p.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "grep", CallID: id,
+				Status: squad.ToolStatusOK, Detail: "ok " + id})
+		}()
+	}
+	wg.Wait()
+
+	parts := p.parts()
+	if got := len(toolCallsOf(parts)); got != calls {
+		t.Fatalf("tool call parts = %d, want %d", got, calls)
+	}
+	results := toolResultsOf(parts)
+	if len(results) != calls {
+		t.Fatalf("tool result parts = %d, want %d", len(results), calls)
+	}
+	seenStart := map[string]bool{}
+	for _, c := range toolCallsOf(parts) {
+		if seenStart[c.ID] {
+			t.Fatalf("duplicate start for %s", c.ID)
+		}
+		seenStart[c.ID] = true
+	}
+	emitted := map[string]string{}
+	for _, r := range results {
+		if _, dup := emitted[r.CallID]; dup {
+			t.Fatalf("duplicate end for %s", r.CallID)
+		}
+		emitted[r.CallID] = r.Status
+		if !seenStart[r.CallID] {
+			t.Fatalf("end without start: %s", r.CallID)
+		}
+	}
+	for id, status := range emitted {
+		if status != wantStatus[id] {
+			t.Fatalf("end %s status = %q, want %q", id, status, wantStatus[id])
+		}
+	}
+}
+
+// TestSquadEventsConcurrentToolCallbacksShareArtifactList：宿主工具被并行调用时，
+// 登记的工件一条都不能丢，snapshot 也不应把内部切片直接交出去。
+func TestSquadEventsConcurrentToolCallbacksShareArtifactList(t *testing.T) {
+	const n = 128
+	produced := &artifactList{}
+	var wg sync.WaitGroup
+	for i := 0; i < n; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			produced.add(&core.ArtifactRef{ArtifactID: core.ID(fmt.Sprintf("art_%03d", i)), Name: "纪要.docx", Kind: "document"})
+		}(i)
+	}
+	wg.Wait()
+	got := produced.snapshot()
+	if len(got) != n {
+		t.Fatalf("artifacts = %d, want %d", len(got), n)
+	}
+	ids := map[string]bool{}
+	for _, ref := range got {
+		ids[string(ref.ArtifactID)] = true
+	}
+	for i := 0; i < n; i++ {
+		if !ids[fmt.Sprintf("art_%03d", i)] {
+			t.Fatalf("missing artifact %d", i)
+		}
+	}
+	got[0] = nil // 快照必须是副本：改动不得回写内部表
+	if produced.snapshot()[0] == nil {
+		t.Fatal("snapshot aliases the internal list")
+	}
+}
+
+// TestSquadEventsFinalTextMatchesToolOutcome：未恢复的失败不得被收尾文本改写成成功；
+// 同名工具重试成功后收尾文本恢复旧行为。
+func TestSquadEventsFinalTextMatchesToolOutcome(t *testing.T) {
+	p := newEventProbe()
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: "run_command", CallID: "c1"})
+	p.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "run_command", CallID: "c1",
+		Status: squad.ToolStatusCanceled, ErrorReason: "用户取消"})
+	if got := p.rec.finalReply("", "", "已完成。"); got == "已完成。" || !strings.Contains(got, "run_command") || !strings.Contains(got, "用户取消") {
+		t.Fatalf("fallback text = %q", got)
+	}
+	if got := p.rec.finalReply("已按你的要求处理。", "", "已完成。"); got != "已按你的要求处理。" {
+		t.Fatalf("model text must be preserved: %q", got)
+	}
+	// 失败部件必须留在最终部件里，不被收尾文本覆盖。
+	if results := toolResultsOf(p.parts()); len(results) != 1 || results[0].Status != squad.ToolStatusCanceled {
+		t.Fatalf("failure part dropped: %+v", results)
+	}
+
+	// 同名工具重试成功 → 失败记为已恢复，兜底文本回到旧行为。
+	q := newEventProbe()
+	q.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: "run_command", CallID: "c1"})
+	q.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "run_command", CallID: "c1",
+		Status: squad.ToolStatusError, ErrorReason: "超时"})
+	q.onEvent(squad.ProcessEvent{Type: "tool_execution_start", Tool: "run_command", CallID: "c2"})
+	q.onEvent(squad.ProcessEvent{Type: "tool_execution_end", Tool: "run_command", CallID: "c2",
+		Status: squad.ToolStatusOK, Detail: "done"})
+	if f := q.rec.unresolvedFailure(); f != nil {
+		t.Fatalf("retry should clear the failure: %+v", f)
+	}
+	if got := q.rec.finalReply("", "", "已完成。"); got != "已完成。" {
+		t.Fatalf("recovered run fallback = %q", got)
+	}
+}
+
+// entryProbe 在真实运行桩上记录工具事件载荷，并让指定工具真的失败，
+// 用来端到端验证「工具结局 → 过程事件 → 落库部件」这条链。
+type entryProbe struct {
+	*entryFake
+	mu      sync.Mutex
+	calls   []core.ToolCallPayload
+	results []core.ToolResultPayload
+}
+
+func (p *entryProbe) Emit(typ core.StreamEventType, payload any) error {
+	switch v := payload.(type) {
+	case core.ToolCallPayload:
+		p.mu.Lock()
+		p.calls = append(p.calls, v)
+		p.mu.Unlock()
+	case core.ToolResultPayload:
+		p.mu.Lock()
+		p.results = append(p.results, v)
+		p.mu.Unlock()
+	}
+	return p.entryFake.Emit(typ, payload)
+}
+
+func (p *entryProbe) ExecuteTool(call core.ToolCallRequest) core.ToolCallResult {
+	if call.Name == "knowledge_search" {
+		return core.ToolCallResult{Status: "error", Output: "索引不可用"}
+	}
+	return p.entryFake.ExecuteTool(call)
+}
+
+func (p *entryProbe) resultPayloads() []core.ToolResultPayload {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return append([]core.ToolResultPayload(nil), p.results...)
+}
+
+// TestSquadEntryFailedToolReachesFinalParts：真实跑一次小队入口，同名并行工具
+// 必须按各自 CallID 落部件，失败必须显示为失败，且不被收尾文本改写成成功。
+func TestSquadEntryFailedToolReachesFinalParts(t *testing.T) {
+	dir := t.TempDir()
+	base := baseEntry(dir)
+	rc := &entryProbe{entryFake: base}
+	rc.tools = []core.ToolDesc{{Name: "knowledge_search", Description: "查资料", Parameters: json.RawMessage(`{"type":"object"}`)}}
+
+	runner := &SquadRunner{
+		Router: fixedRoute{mode: squad.RouteDirect}, Checker: squad.MinimalChecker{},
+		Hitl: squad.HitlPolicy{Mode: squad.HitlDisabled},
+		Stream: scriptedCalls(t, nil, [][]agentllm.Event{
+			{{Kind: agentllm.KindMessageEnd, Message: agentllm.Message{Role: agentllm.RoleAssistant, StopReason: agentllm.StopToolCalls,
+				ToolCalls: []agentllm.ToolCall{
+					{ID: "call_k1", Name: "knowledge_search", Arguments: `{"q":"a"}`},
+					{ID: "call_k2", Name: "knowledge_search", Arguments: `{"q":"b"}`},
+				}}}},
+			{{Kind: agentllm.KindMessageEnd, Message: agentllm.Message{Role: agentllm.RoleAssistant, StopReason: agentllm.StopToolCalls,
+				ToolCalls: []agentllm.ToolCall{{ID: "w", Name: "write_file", Arguments: mustDocArgs()}}}}},
+			{{Kind: agentllm.KindTextDelta, Text: "写完了。"},
+				{Kind: agentllm.KindMessageEnd, Message: agentllm.Message{Role: agentllm.RoleAssistant, Content: "写完了。", StopReason: agentllm.StopEnd}}},
+		}),
+	}
+	if err := runner.Execute(rc); err != nil {
+		t.Fatal(err)
+	}
+	parts := base.parts
+	calls := toolCallsOf(parts)
+	ids := map[string]bool{}
+	for _, c := range calls {
+		if c.Name != "knowledge_search" {
+			continue
+		}
+		if c.ID == "knowledge_search" || ids[c.ID] {
+			t.Fatalf("tool call part lost its call id: %+v (all %+v)", c, calls)
+		}
+		ids[c.ID] = true
+	}
+	if len(ids) != 2 {
+		t.Fatalf("distinct call ids = %v", ids)
+	}
+	results := toolResultsOf(parts)
+	search := map[string]core.ToolResultPart{}
+	for _, r := range results {
+		if ids[r.CallID] {
+			search[r.CallID] = r
+		}
+	}
+	if len(search) != 2 {
+		t.Fatalf("tool results for knowledge_search = %+v", results)
+	}
+	for id, r := range search {
+		if r.Status != squad.ToolStatusError {
+			t.Fatalf("%s status = %q, want error", id, r.Status)
+		}
+		if r.Summary != "索引不可用" {
+			t.Fatalf("%s summary = %q", id, r.Summary)
+		}
+	}
+	// 发射载荷与落库部件一致：前端过程行不得说 ok。
+	emitted := map[string]string{}
+	for _, pl := range rc.resultPayloads() {
+		if ids[pl.CallID] {
+			emitted[pl.CallID] = pl.Status
+		}
+	}
+	for id, r := range search {
+		if emitted[id] != r.Status {
+			t.Fatalf("emitted %s status = %q, part status = %q", id, emitted[id], r.Status)
+		}
+	}
+	// 收尾文本保留模型原话，失败部件不被覆盖。
+	if last := parts[len(parts)-1]; last.Type != core.PartText || last.Text != "写完了。" {
+		t.Fatalf("final part = %+v", last)
+	}
+}

internal/runtime/squad_runner.go

@@ -30,37 +30,8 @@ func (s *SquadRunner) Execute(rc RunCtx) error {
 	prof := rc.Profile()
 	maxTurns, maxTools := loopCaps(prof.Budget)
 	produced := &artifactList{}
-	var streamed strings.Builder
-	var toolParts []core.Part
-	textIdx := 0
-	onEvent := func(ev squad.ProcessEvent) {
-		switch ev.Type {
-		case "text_delta":
-			if ev.Text == "" {
-				return
-			}
-			streamed.WriteString(ev.Text)
-			_ = rc.Emit(core.EvMessageDelta, core.MessageDeltaPayload{Index: textIdx, Text: ev.Text})
-		case "reasoning_delta":
-			if ev.Text != "" {
-				_ = rc.Emit(core.EvThinkingDelta, core.ThinkingDeltaPayload{Text: ev.Text})
-			}
-		case "tool_execution_start":
-			_ = rc.Emit(core.EvToolCall, core.ToolCallPayload{CallID: ev.Tool, Name: ev.Tool, Arguments: ev.Detail})
-			toolParts = append(toolParts, core.Part{Type: core.PartToolCall, Process: true, ToolCall: &core.ToolCallPart{ID: ev.Tool, Name: ev.Tool, Arguments: ev.Detail}})
-		case "tool_execution_end":
-			_ = rc.Emit(core.EvToolResult, core.ToolResultPayload{CallID: ev.Tool, Status: "ok", Summary: truncateRun(ev.Detail, 160)})
-			toolParts = append(toolParts, core.Part{Type: core.PartToolResult, Process: true, ToolResult: &core.ToolResultPart{CallID: ev.Tool, Status: "ok", Summary: truncateRun(ev.Detail, 160)}})
-		case "usage":
-			if sink, ok := rc.(interface{ AddUsage(core.Usage) }); ok {
-				sink.AddUsage(core.Usage{
-					PromptTokens: ev.PromptTokens, CompletionTokens: ev.CompletionTokens, TotalTokens: ev.PromptTokens + ev.CompletionTokens,
-					LastPromptTokens: ev.LastPromptTokens, LastCompletionTokens: ev.LastCompletionTokens,
-					CacheReadTokens: ev.CacheReadTokens, CacheWriteTokens: ev.CacheWriteTokens,
-				})
-			}
-		}
-	}
+	// 过程帧可能来自并行的工具回调：聚合全部走 squadEventLog（内部互斥）。
+	evlog := newSquadEventLog(rc)
 	router := s.Router
 	if router == nil {
 		router = newModelRouter(rc)
@@ -73,14 +44,16 @@ func (s *SquadRunner) Execute(rc RunCtx) error {
 		DataDir:      rc.Settings().GetString("storage.dataDir", "./data"),
 		Goal:         entryGoal(rc),
 		HostTools:    bridgeHostTools(rc, produced),
-		OnEvent:      onEvent,
+		OnEvent:      evlog.onEvent,
 		Stream:       stream,
 		Router:       router,
 		Checker:      s.Checker,
 		Hitl:         s.Hitl,
 		MaxTurns:     maxTurns,
 		MaxToolCalls: maxTools,
-		Model:        ResolveChatModel(prof, rc.Settings()).Model,
+		// 模型走本次运行的生效配置（当前用户/项目 + 画像覆盖），与直连同一
+		// 解析规则：内核工厂用同一快照配端点/密钥，绝不与默认账号混搭。
+		Model: RunChatRoute(rc).Model,
 	})
 	if rc.Context().Err() != nil {
 		return rc.Context().Err()
@@ -88,14 +61,9 @@ func (s *SquadRunner) Execute(rc RunCtx) error {
 	if err != nil {
 		return err
 	}
-	reply := strings.TrimSpace(streamed.String())
-	if reply == "" {
-		reply = strings.TrimSpace(res.Summary)
-	}
-	if reply == "" {
-		reply = "已完成。"
-	}
-	if claimsFalseDeliverable(reply, produced.items, rc) {
+	// 收尾文本：模型文本原样保留；仍有未恢复的工具失败时不用「已完成。」兜底。
+	reply := evlog.finalReply(evlog.reply(), res.Summary, "已完成。")
+	if claimsFalseDeliverable(reply, produced.snapshot(), rc) {
 		return fmt.Errorf("声称已生成文件，但没有登记对应工件")
 	}
 	if strings.TrimSpace(res.Body) != "" {
@@ -103,9 +71,9 @@ func (s *SquadRunner) Execute(rc RunCtx) error {
 			return werr
 		}
 	}
-	parts := append([]core.Part{}, toolParts...)
+	parts := evlog.toolParts()
 	parts = append(parts, core.Part{Type: core.PartText, Text: reply})
-	for _, ref := range produced.items {
+	for _, ref := range produced.snapshot() {
 		parts = append(parts, core.Part{Type: core.PartArtifactRef, Artifact: ref})
 	}
 	return rc.SetAssistantParts(parts)
@@ -143,7 +111,7 @@ func newModelRouter(rc RunCtx) modelRouter {
 	if route.Model == "" || route.Base == "" {
 		return modelRouter{}
 	}
-	client := openRouteClient(route, rc.Settings())
+	client := OpenRouteClient(route, rc.Settings())
 	return modelRouter{stream: GuardProjectStream(rc, "", client.Stream), model: route.Model}
 }
 

internal/runtime/sub_loop.go

@@ -80,7 +80,7 @@ func (l *SubLLMRunner) Execute(rc RunCtx) error {
 		if route.Model == "" || route.Base == "" {
 			return fmt.Errorf("llm-subagent: 模型未配置（当前解析：model=%q base=%q）", route.Model, route.Base)
 		}
-		client := openRouteClient(route, rc.Settings())
+		client := OpenRouteClient(route, rc.Settings())
 		stream = client.Stream
 	}
 	stream = GuardProjectStream(rc, subagentUserText(rc), stream)

internal/runtime/verify.go

@@ -58,7 +58,7 @@ func (l *LLMRunner) runVerifier(rc RunCtx, body string, evidence []toolEvidence,
 		if route.Model == "" || route.Base == "" {
 			return gates.Verdict{}, fmt.Errorf("验证器调用失败")
 		}
-		client := openRouteClient(route, rc.Settings())
+		client := OpenRouteClient(route, rc.Settings())
 		// 验证器不经内核循环：显式接重试（WP6 同映射）与 5xx 回退链。
 		stream = agentllm.WithFallback(
 			agentllm.WithRetry(client.Stream, retryAttemptsOf(rc.Settings()), nil),

internal/runtime/workflow_compiled.go

@@ -81,7 +81,7 @@ func judgeStreamFor(rc RunCtx) agentllm.StreamFunc {
 	if route.Model == "" || route.Base == "" {
 		return nil
 	}
-	client := openRouteClient(route, rc.Settings())
+	client := OpenRouteClient(route, rc.Settings())
 	model := route.Model
 	base := func(ctx context.Context, _ string, msgs []agentllm.Message, tools []agentllm.ToolDecl, opts agentllm.StreamOptions) <-chan agentllm.Event {
 		return client.Stream(ctx, model, msgs, tools, opts)

internal/server/e2e_test.go

@@ -946,7 +946,7 @@ func TestStaticServed(t *testing.T) {
 	_ = io.Discard
 }
 
-// TestHITLIntentPivot：装载插件意图后，自由输入命中其他意图 → 转轨（agent-intent 闸门）。
+// TestHITLIntentPivot：装载插件意图后，自由输入命中其他意图 → 转轨（intentgate 闸门）。
 func TestHITLIntentPivot(t *testing.T) {
 	srv, _ := newTestServer(t)
 	h := srv.Handler()

internal/server/intent_admission.go

@@ -0,0 +1,206 @@
+package server
+
+// 意图接纳（F09）：把「一次识别」落到「一次命令派发」之前，
+// 按命令 DECLARED schema 完成参数映射与准入判定：
+//   - 只映射命令声明过的槽位键，并按声明类型转换（string/number/integer/boolean）；
+//     未声明的键一律丢弃——不把任意字符串复制进 params。
+//   - 声明的必填参数无法由「原文 + 已识别槽位」满足时不派发：不把拒绝留给
+//     总线层的 schema 校验（那会变成一条让人困惑的 "params: missing required
+//     param x"），而是转成澄清诉求，与路由层的槽位缺口同一出口。
+//
+// 确认语义（高危命令的确认卡）完全由 cmdbus 收口，本文件不参与。
+
+import (
+	"encoding/json"
+	"sort"
+	"strconv"
+	"strings"
+
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/intentgate"
+	"agent-system-backend/internal/route"
+)
+
+// chatTextParam 是 chat 入口恒定提供的原始文本参数名（既有文本处理器契约）。
+const chatTextParam = "text"
+
+// intentAdmission 是一次「意图命中 → 命令派发」的接纳结果。
+type intentAdmission struct {
+	// Params 是派发参数：恒含 text，其余按声明 schema 映射。
+	Params map[string]any
+	// Blocked 表示准入未过（业务动作不得派发）。
+	Blocked bool
+	// Reason 是准入未过的原因（诊断用；面向用户的说法走澄清诉求）。
+	Reason string
+	// MissingParams 是声明要求但槽位无法满足的参数名（按声明序）。
+	MissingParams []string
+}
+
+// admitIntentCommand 按命令声明的 schema 把已识别槽位映射成派发参数。
+// 声明不可解析（命令不存在/未启用）时按 fail-closed 返回 Blocked。
+func admitIntentCommand(bus *cmdbus.Bus, commandID string, slots map[string]string, text string) intentAdmission {
+	if bus == nil {
+		return intentAdmission{Blocked: true, Reason: "命令总线不可用：" + commandID}
+	}
+	spec, _, err := bus.Registry().Resolve(commandID)
+	if err != nil {
+		return intentAdmission{Blocked: true, Reason: "命令不可解析：" + commandID}
+	}
+	params, missing := mapSchemaParams(spec.ParamsSchema, slots)
+	params[chatTextParam] = text
+	if len(missing) > 0 {
+		return intentAdmission{Params: params, Blocked: true,
+			Reason:        "命令必填参数未满足：" + strings.Join(missing, "、"),
+			MissingParams: missing}
+	}
+	return intentAdmission{Params: params}
+}
+
+// mapSchemaParams 把槽位按 JSON Schema（draft-07 子集，与总线侧校验同款）
+// 投影成参数。只认声明过的键，并按声明类型转换；转换不成的不写参数
+// （数组/对象等非标量声明也不会收到字符串）。必填参数里无法满足的按键名返回。
+func mapSchemaParams(schema json.RawMessage, slots map[string]string) (map[string]any, []string) {
+	params := map[string]any{}
+	props, required, ok := objectSchema(schema)
+	if !ok {
+		// 没有可用声明：不复制任何槽位（fail-closed），只保留原文入口参数。
+		return params, nil
+	}
+	keys := make([]string, 0, len(slots))
+	for k := range slots {
+		if _, declared := props[k]; declared {
+			keys = append(keys, k)
+		}
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		if v, ok := castParam(props[k], slots[k]); ok {
+			params[k] = v
+		}
+	}
+	var missing []string
+	for _, k := range required {
+		if k == chatTextParam {
+			continue // 原文入口恒供
+		}
+		if _, ok := params[k]; !ok {
+			missing = append(missing, k)
+		}
+	}
+	return params, missing
+}
+
+// objectSchema 解析命令的 paramsSchema；非对象/非法 schema 返回 ok=false。
+func objectSchema(schema json.RawMessage) (props map[string]any, required []string, ok bool) {
+	if len(schema) == 0 {
+		return nil, nil, false
+	}
+	var sc struct {
+		Type       string         `json:"type"`
+		Required   []string       `json:"required"`
+		Properties map[string]any `json:"properties"`
+	}
+	if err := json.Unmarshal(schema, &sc); err != nil {
+		return nil, nil, false
+	}
+	if sc.Type != "" && sc.Type != "object" {
+		return nil, nil, false
+	}
+	if sc.Properties == nil {
+		sc.Properties = map[string]any{}
+	}
+	return sc.Properties, sc.Required, true
+}
+
+// castParam 按声明类型把槽位字符串转成参数值；类型不支持或转换失败返回 false。
+func castParam(decl any, raw string) (any, bool) {
+	m, _ := decl.(map[string]any)
+	want, _ := m["type"].(string)
+	switch want {
+	case "", "string":
+		return raw, true
+	case "number":
+		f, err := strconv.ParseFloat(strings.TrimSpace(raw), 64)
+		if err != nil {
+			return nil, false
+		}
+		return f, true
+	case "integer":
+		n, err := strconv.ParseInt(strings.TrimSpace(raw), 10, 64)
+		if err != nil {
+			return nil, false
+		}
+		return n, true
+	case "boolean":
+		b, err := strconv.ParseBool(strings.TrimSpace(raw))
+		if err != nil {
+			return nil, false
+		}
+		return b, true
+	default:
+		// array/object 等非标量声明：拒绝把字符串塞进去。
+		return nil, false
+	}
+}
+
+// clarifyPayload 是回给调用方的澄清诉求（postMessage 响应里的 clarify 字段）。
+// 既有端点上的附加字段，不新增 API 面：缺失与非法各自带 key/原因/建议提问。
+type clarifyPayload struct {
+	Intent   string                    `json:"intent,omitempty"`
+	Command  string                    `json:"command,omitempty"`
+	Question string                    `json:"question,omitempty"`
+	Reason   string                    `json:"reason,omitempty"`
+	Missing  []intentgate.SlotQuestion `json:"missing,omitempty"`
+	Invalid  []intentgate.SlotDefect   `json:"invalid,omitempty"`
+}
+
+// newClarifyPayload 把路由裁决与准入结果合成一条澄清诉求；无需澄清时返回 nil。
+func newClarifyPayload(res intentgate.MatchResult, dec route.Decision, adm *intentAdmission) *clarifyPayload {
+	if !dec.Clarification.Needed && (adm == nil || !adm.Blocked) {
+		return nil
+	}
+	c := dec.Clarification
+	out := &clarifyPayload{
+		Intent:   res.ID,
+		Command:  firstNonEmpty(c.Command, dec.CommandID),
+		Question: strings.TrimSpace(c.Question),
+		Missing:  append([]intentgate.SlotQuestion(nil), c.Missing...),
+		Invalid:  append([]intentgate.SlotDefect(nil), c.Invalid...),
+	}
+	if adm != nil && adm.Blocked {
+		out.Reason = adm.Reason
+		names := make([]string, 0, len(adm.MissingParams))
+		for _, name := range adm.MissingParams {
+			if slotQuestionKnown(out.Missing, name) {
+				continue
+			}
+			out.Missing = append(out.Missing, intentgate.SlotQuestion{Key: name, Question: name})
+			names = append(names, name)
+		}
+		if out.Question == "" && len(names) > 0 {
+			out.Question = "请补充：" + strings.Join(names, "、")
+		}
+	}
+	if out.Question == "" {
+		return nil
+	}
+	return out
+}
+
+func slotQuestionKnown(list []intentgate.SlotQuestion, key string) bool {
+	for _, q := range list {
+		if q.Key == key {
+			return true
+		}
+	}
+	return false
+}
+
+func firstNonEmpty(vals ...string) string {
+	for _, v := range vals {
+		if v != "" {
+			return v
+		}
+	}
+	return ""
+}

internal/server/intent_admission_test.go

@@ -0,0 +1,398 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+	"testing"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/intentgate"
+)
+
+// F09 意图接纳：槽位缺失/非法一律不派发业务动作；合法槽位按命令 DECLARED
+// schema 映射后进处理器；高危命令的确认语义完全由 cmdbus 收口（此处不动）。
+
+// reportIntent 声明一个带枚举校验与多个可选槽位的意图（合成数据）。
+func reportIntent() json.RawMessage {
+	return json.RawMessage(`{"id":"demo.report","domain":"demo","version":1,
+		"matcher":{"includes_any":["生成报告"]},
+		"slots":[
+			{"key":"topic","required":true,"pattern":"主题[:：]\\s*(\\S+)","question":"主题是什么？"},
+			{"key":"mode","required":true,"pattern":"模式[:：]\\s*(\\S+)","enum":["摘要","全文"],"question":"要哪种模式？"},
+			{"key":"count","pattern":"份数[:：]\\s*(\\S+)"},
+			{"key":"enabled","pattern":"归档[:：]\\s*(\\S+)"},
+			{"key":"note","pattern":"备注[:：]\\s*(\\S+)"}]}`)
+}
+
+// reportCommandSpec 声明参数 schema：count 是 integer、enabled 是 boolean，
+// note 未声明——未声明的键不得被塞进 params。
+func reportCommandSpec() agentcommand.CommandSpec {
+	return agentcommand.CommandSpec{ID: "demo.report", Title: "生成报告命令",
+		ParamsSchema: json.RawMessage(`{"type":"object","required":["text","topic","mode"],
+			"properties":{"topic":{"type":"string"},"mode":{"type":"string"},
+			"count":{"type":"integer"},"enabled":{"type":"boolean"}}}`)}
+}
+
+// dispatchLog 记录每次真实派发（处理器被调用才算执行）。
+type dispatchLog struct {
+	mu     sync.Mutex
+	calls  []cmdbus.Request
+	params []map[string]any
+}
+
+func (l *dispatchLog) record(req cmdbus.Request) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	copied := map[string]any{}
+	for k, v := range req.Params {
+		copied[k] = v
+	}
+	l.calls = append(l.calls, req)
+	l.params = append(l.params, copied)
+}
+
+func (l *dispatchLog) snapshot() []map[string]any {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return append([]map[string]any(nil), l.params...)
+}
+
+func (l *dispatchLog) byOwner() map[string]map[string]any {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	out := map[string]map[string]any{}
+	for _, req := range l.calls {
+		out[req.Owner] = req.Params
+	}
+	return out
+}
+
+// admissionServer 组装带意图闸门与 demo.report 命令的测试服务器。
+func admissionServer(t *testing.T) (*Server, *dispatchLog) {
+	t.Helper()
+	return admissionServerWith(t, reportCommandSpec())
+}
+
+func admissionServerWith(t *testing.T, spec agentcommand.CommandSpec) (*Server, *dispatchLog) {
+	t.Helper()
+	srv, _ := newTestServer(t)
+	log := &dispatchLog{}
+	if err := srv.Bus.RegisterBuiltin(spec, "", func(_ context.Context, req cmdbus.Request) (any, error) {
+		log.record(req)
+		return map[string]any{"ok": true}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	gate := intentgate.New()
+	if err := gate.Rebuild(context.Background(), []json.RawMessage{reportIntent()}); err != nil {
+		t.Fatal(err)
+	}
+	srv.Gate = gate
+	return srv, log
+}
+
+func clarifyOf(t *testing.T, out map[string]any) map[string]any {
+	t.Helper()
+	c, ok := out["clarify"].(map[string]any)
+	if !ok {
+		t.Fatalf("响应缺少澄清诉求：%v", out)
+	}
+	return c
+}
+
+// 缺必填槽位：不执行业务命令，澄清诉求带正确的提问。
+func TestMissingSlotBlocksCommandAndSurfacesClarification(t *testing.T) {
+	srv, log := admissionServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "生成报告 模式：摘要"})
+	if code != 200 {
+		t.Fatalf("status %d body %v", code, out)
+	}
+	if _, executed := out["command"]; executed {
+		t.Fatalf("缺必填槽位不得执行业务命令：%v", out)
+	}
+	if out["run"] == nil {
+		t.Fatalf("未派发命令时应回落普通回合：%v", out)
+	}
+	c := clarifyOf(t, out)
+	if c["question"] != "主题是什么？" {
+		t.Fatalf("澄清提问：%v", c)
+	}
+	if c["command"] != "demo.report" || c["intent"] != "demo.report" {
+		t.Fatalf("被拦下的动作未标明：%v", c)
+	}
+	missing, _ := c["missing"].([]any)
+	if len(missing) != 1 {
+		t.Fatalf("缺失槽位明细：%v", c)
+	}
+	if m := missing[0].(map[string]any); m["key"] != "topic" || m["question"] != "主题是什么？" {
+		t.Fatalf("缺失槽位键/提问：%v", m)
+	}
+	if _, bad := c["invalid"]; bad {
+		t.Fatalf("缺失不应混进非法：%v", c)
+	}
+	if got := log.snapshot(); len(got) != 0 {
+		t.Fatalf("命令处理器被调用：%v", got)
+	}
+}
+
+// 非法枚举值：不执行业务命令，结构化原因原样透出。
+func TestInvalidSlotBlocksCommandWithReason(t *testing.T) {
+	srv, log := admissionServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "生成报告 主题：核能 模式：随手写"})
+	if code != 200 {
+		t.Fatalf("status %d body %v", code, out)
+	}
+	if _, executed := out["command"]; executed {
+		t.Fatalf("非法槽位不得执行业务命令：%v", out)
+	}
+	c := clarifyOf(t, out)
+	if c["question"] != "要哪种模式？" {
+		t.Fatalf("澄清提问：%v", c)
+	}
+	invalid, _ := c["invalid"].([]any)
+	if len(invalid) != 1 {
+		t.Fatalf("非法槽位明细：%v", c)
+	}
+	got := invalid[0].(map[string]any)
+	if got["key"] != "mode" || got["reason"] != "value not in enum" || got["question"] != "要哪种模式？" {
+		t.Fatalf("非法原因/提问未透传：%v", got)
+	}
+	if got["invalid"] != true {
+		t.Fatalf("非法标记：%v", got)
+	}
+	if _, missing := c["missing"]; missing {
+		t.Fatalf("非法不应重复计入缺失：%v", c)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("命令处理器被调用：%v", log.snapshot())
+	}
+}
+
+// 合法槽位：按声明 schema 映射后到达处理器（类型正确、未声明键不复制）。
+func TestValidSlotsReachHandlerMappedPerSchema(t *testing.T) {
+	srv, log := admissionServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	text := "生成报告 主题：核能 模式：摘要 份数：3 归档：true 备注：随便"
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages", map[string]any{"text": text})
+	if code != 200 || out["command"] != "demo.report" {
+		t.Fatalf("status %d body %v", code, out)
+	}
+	if _, ok := out["clarify"]; ok {
+		t.Fatalf("完整合法槽位不应带澄清诉求：%v", out)
+	}
+	calls := log.snapshot()
+	if len(calls) != 1 {
+		t.Fatalf("处理器调用次数：%d", len(calls))
+	}
+	params := calls[0]
+	if params["topic"] != "核能" || params["mode"] != "摘要" || params["text"] != text {
+		t.Fatalf("字符串参数映射：%v", params)
+	}
+	if params["count"] != int64(3) {
+		t.Fatalf("integer 参数映射：%#v", params["count"])
+	}
+	if params["enabled"] != true {
+		t.Fatalf("boolean 参数映射：%#v", params["enabled"])
+	}
+	if _, ok := params["note"]; ok {
+		t.Fatalf("未声明的槽位不得复制进 params：%v", params)
+	}
+	if len(params) != 5 {
+		t.Fatalf("参数量超出声明：%v", params)
+	}
+}
+
+// 声明的必填参数无法由原文+槽位满足：不派发，转澄清（不再由总线报 schema 错）。
+func TestDeclaredRequiredParamBlocksDispatch(t *testing.T) {
+	srv, log := admissionServerWith(t, agentcommand.CommandSpec{ID: "demo.report", Title: "生成报告命令",
+		ParamsSchema: json.RawMessage(`{"type":"object","required":["text","target"],
+			"properties":{"topic":{"type":"string"},"target":{"type":"string"}}}`)})
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "生成报告 主题：核能 模式：摘要"})
+	if code != 200 {
+		t.Fatalf("status %d body %v", code, out)
+	}
+	if _, executed := out["command"]; executed {
+		t.Fatalf("必填参数缺失不得执行业务命令：%v", out)
+	}
+	c := clarifyOf(t, out)
+	missing, _ := c["missing"].([]any)
+	found := false
+	for _, m := range missing {
+		if m.(map[string]any)["key"] == "target" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("缺失必填参数未透出：%v", c)
+	}
+	if c["reason"] == "" {
+		t.Fatalf("准入原因缺失：%v", c)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("命令处理器被调用：%v", log.snapshot())
+	}
+}
+
+// 高危命令仍走 cmdbus 的确认卡收口：接纳通过后创建确认卡，处理器不执行。
+func TestHighRiskCommandStillRequiresConfirmation(t *testing.T) {
+	srv, log := admissionServer(t)
+	h := srv.Handler()
+	gate := intentgate.New()
+	if err := gate.Rebuild(context.Background(), []json.RawMessage{
+		reportIntent(),
+		json.RawMessage(`{"id":"demo.purge","domain":"demo","version":1,
+			"matcher":{"includes_any":["清除报告"]},
+			"action":{"kind":"command","id":"demo.purge"},
+			"slots":[{"key":"topic","required":true,"pattern":"对象[:：]\\s*(\\S+)","question":"清除哪个对象？"}]}`),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	srv.Gate = gate
+	if err := srv.Bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.purge", Title: "清除报告",
+		Danger: agentcommand.DangerHigh,
+		ParamsSchema: json.RawMessage(`{"type":"object","required":["text","topic"],
+			"properties":{"topic":{"type":"string"}}}`)}, "", func(context.Context, cmdbus.Request) (any, error) {
+		t.Fatalf("高危命令未经确认不得执行处理器")
+		return nil, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// 缺必填槽位时连确认卡都不该出现（业务动作根本没到总线）。
+	_, blocked := setupConversation(t, h)
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+blocked+"/messages",
+		map[string]any{"text": "清除报告"})
+	if code != 200 {
+		t.Fatalf("status %d body %v", code, out)
+	}
+	if _, hasCard := out["card"]; hasCard {
+		t.Fatalf("槽位未就绪不得创建确认卡：%v", out)
+	}
+	if _, executed := out["command"]; executed {
+		t.Fatalf("槽位未就绪不得执行业务命令：%v", out)
+	}
+
+	// 槽位齐全：派发到总线，高危收口创建确认卡，处理器仍未执行。
+	_, ready := setupConversation(t, h)
+	code, out = doJSON(t, h, "POST", "/api/conversations/"+ready+"/messages",
+		map[string]any{"text": "清除报告 对象：旧归档"})
+	if code != 200 || out["command"] != "demo.purge" {
+		t.Fatalf("status %d body %v", code, out)
+	}
+	if out["card"] == nil {
+		t.Fatalf("高危命令必须要求确认：%v", out)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("确认前不得派发其他命令：%v", log.snapshot())
+	}
+}
+
+// 显式取消命令宿主未实现：如实回落普通回合，不派发同一句里的 Start。
+type cancelGenerator struct{}
+
+// 生成器只经 intentgate 表面接线：目录与命令类型都由闸门投影，
+// 宿主实现不必（也不应）直接导入生态库。
+func (cancelGenerator) Generate(context.Context, string, []intentgate.CatalogSpec) ([]intentgate.Command, error) {
+	return []intentgate.Command{
+		{Kind: intentgate.CommandStart, Action: intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.report"}},
+		{Kind: intentgate.CommandCancel, Target: "demo.report"},
+	}, nil
+}
+
+func TestUnsupportedCancelCommandFallsBackToTurn(t *testing.T) {
+	srv, log := admissionServer(t)
+	h := srv.Handler()
+	gate, ok := srv.Gate.(*intentgate.Gate)
+	if !ok {
+		t.Fatalf("闸门类型：%T", srv.Gate)
+	}
+	gate.SetGenerator(cancelGenerator{})
+	_, convID := setupConversation(t, h)
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "算了吧 生成报告"})
+	if code != 200 {
+		t.Fatalf("status %d body %v", code, out)
+	}
+	if _, executed := out["command"]; executed {
+		t.Fatalf("未支持的取消命令不得派发业务动作：%v", out)
+	}
+	if out["run"] == nil {
+		t.Fatalf("未支持的库层命令应回落普通回合：%v", out)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("命令处理器被调用：%v", log.snapshot())
+	}
+}
+
+// 两个租户的槽位上下文互不串味：各自只看到自己那句输入映射出的参数。
+func TestIntentSlotsDoNotLeakAcrossOwners(t *testing.T) {
+	srv, log := admissionServer(t)
+	srv.Auth = NewAuthenticator(srv.st, true)
+	convID := map[string]string{}
+	for _, owner := range []string{"alice", "bob"} {
+		if err := srv.st.CreateAccount(owner, owner, "", true); err != nil {
+			t.Fatal(err)
+		}
+		proj, err := srv.st.CreateProject(owner, owner+" 的项目")
+		if err != nil {
+			t.Fatal(err)
+		}
+		conv, err := srv.st.CreateConversation(owner, proj.ID, owner+" 的会话", "")
+		if err != nil {
+			t.Fatal(err)
+		}
+		convID[owner] = conv.ID
+	}
+	h := srv.Handler()
+	send := func(owner, text string) map[string]any {
+		t.Helper()
+		key, err := srv.st.CreateAPIKey(owner, owner+"-key")
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, err := json.Marshal(map[string]any{"text": text})
+		if err != nil {
+			t.Fatal(err)
+		}
+		rec := bearerRequest(h, "POST", "/api/conversations/"+convID[owner]+"/messages", string(body), key)
+		out := map[string]any{}
+		if rec.Body.Len() > 0 {
+			json.Unmarshal(rec.Body.Bytes(), &out)
+		}
+		if rec.Code != 200 {
+			t.Fatalf("%s 发送 %q: status %d body %s", owner, text, rec.Code, rec.Body.String())
+		}
+		return out
+	}
+	if out := send("alice", "生成报告 主题：核能 模式：摘要"); out["command"] != "demo.report" {
+		t.Fatalf("alice 派发：%v", out)
+	}
+	if out := send("bob", "生成报告 主题：水利 模式：全文"); out["command"] != "demo.report" {
+		t.Fatalf("bob 派发：%v", out)
+	}
+	if got := log.byOwner(); len(got) != 2 {
+		t.Fatalf("派发归属：%v", got)
+	}
+	byOwner := log.byOwner()
+	if byOwner["alice"]["topic"] != "核能" || byOwner["alice"]["mode"] != "摘要" {
+		t.Fatalf("alice 收到别人的槽位：%v", byOwner["alice"])
+	}
+	if byOwner["bob"]["topic"] != "水利" || byOwner["bob"]["mode"] != "全文" {
+		t.Fatalf("bob 收到别人的槽位：%v", byOwner["bob"])
+	}
+	if byOwner["alice"]["topic"] == byOwner["bob"]["topic"] {
+		t.Fatalf("两个租户共享了同一份槽位上下文：%v", byOwner)
+	}
+}

internal/server/intent_cancel.go

@@ -0,0 +1,220 @@
+package server
+
+// 取消路由（A1/U-A1c）：把「取消刚才的任务」这类意图派发成**既有**取消动作。
+//
+// 纪律：
+//   - 唯一入口：路由层解出唯一靶子（原文点名的运行号，或本会话绑定动作的
+//     运行上下文），本文件只负责把它交给既有取消路径，绝不自己发明取消
+//     语义、绝不绕过命令总线。
+//   - 靶子不唯一就不猜：没有绑定也没有点名时如实澄清，并把发起人自己最近
+//     的运行如实列出来（别人的运行在构造上就不可见）。
+//   - 确认语义不变：注册了取消命令的部署走 Bus.Dispatch（与任何高后果
+//     动作同款——审计信封、内联确认卡原样生效，绝不自动确认）；未注册时
+//     回落到 cancelRun 已有的投递（PG 档且 run 不在本实例 → 收件箱持久命令
+//     EnqueueCommandAccountChecked；本实例活跃 → 就地 CancelRun），与
+//     POST /api/runs/{id}/cancel 逐字同款。
+//   - 不谎报成功：投递失败、运行不可见或已终态都如实回话，不写 accepted。
+
+import (
+	"net/http"
+	"sort"
+	"strings"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/intentgate"
+	"agent-system-backend/internal/intentsession"
+	"agent-system-backend/internal/route"
+	"agent-system-backend/internal/runmgr"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+// intentCancelCommandID 是「取消」意图派发时优先使用的命令总线 id：注册了
+// 该命令的部署走与任何其他业务动作同款的分发路径（准入、审计信封、高危
+// 确认卡全部原样生效）；未注册时回落到既有的收件箱投递，语义不变。
+const intentCancelCommandID = "run.cancel"
+
+// intentCancelParam 是取消命令声明里运行号的参数名（与既有取消用例一致）。
+const intentCancelParam = "run_id"
+
+// cancelCandidateLimit 是澄清时如实列出的候选运行上限（防止回话过长）。
+const cancelCandidateLimit = 5
+
+// intentCancelResult 是取消派发的如实回执（响应上的 cancel 字段；不新增 API 面）。
+type intentCancelResult struct {
+	RunID  string `json:"runId"`
+	Source string `json:"source"`
+	Intent string `json:"intent,omitempty"`
+	Action string `json:"action,omitempty"`
+	// Accepted 表示取消请求已被既有路径受理（命令已投递）；高危档还需用户
+	// 显式确认，响应里的 card 就是那道门禁。未受理时 Reason 说明为什么。
+	Accepted bool   `json:"accepted"`
+	Via      string `json:"via"`
+	Reason   string `json:"reason,omitempty"`
+}
+
+// planIntentCancel 裁决要不要真的取消：
+//   - 返回 runID != ""：靶子唯一且对发起人可见，按既有路径派发；
+//   - 返回澄清诉求（runID == ""）：靶子缺失/不可见/候选不唯一——如实澄清，
+//     绝不猜一个。
+//
+// 可见性只认发起人自己的运行：GetRun(owner, id) 查不到就与「不存在」同一
+// 出口（不据此泄露别人的运行是否存在）。
+func (s *Server) planIntentCancel(owner string, conv core.Conversation,
+	res intentgate.MatchResult, dec route.Decision) (string, *clarifyPayload) {
+	t := dec.Cancel
+	if t == nil || strings.TrimSpace(t.RunID) == "" {
+		return "", s.cancelClarify(owner, conv, res, "没有可取消的运行：请点名运行号，或先发起一个任务")
+	}
+	if _, err := s.st.GetRun(owner, t.RunID); err != nil {
+		return "", s.cancelClarify(owner, conv, res, "该运行不可见或不存在")
+	}
+	return t.RunID, nil
+}
+
+// cancelClarify 组装取消的澄清诉求：问题问「取消哪一个」，候选如实列出
+// （发起人自己最近的未终态运行，按新到旧）。一个候选都没有时如实说明。
+func (s *Server) cancelClarify(owner string, conv core.Conversation,
+	res intentgate.MatchResult, reason string) *clarifyPayload {
+	c := &clarifyPayload{Intent: res.ID, Command: intentCancelCommandID, Question: "要取消哪一个任务？", Reason: reason}
+	candidates := s.cancelCandidateRuns(owner, conv.ID)
+	for _, r := range candidates {
+		c.Missing = append(c.Missing, intentgate.SlotQuestion{
+			Key: string(r.ID), Question: "取消运行 " + string(r.ID) + "（" + string(r.Status) + "）"})
+	}
+	if len(candidates) == 0 {
+		c.Question = "现在没有可取消的任务。"
+	}
+	return c
+}
+
+// cancelCandidateRuns 列出发起人自己最近的未终态运行（会话维度、按创建时间
+// 倒序、上限 cancelCandidateLimit）。别人的运行与已终态的运行一律不列。
+func (s *Server) cancelCandidateRuns(owner, convID string) []core.Run {
+	runs, err := s.st.ListRunsByConversation(convID)
+	if err != nil {
+		return nil
+	}
+	out := []core.Run{}
+	for _, r := range runs {
+		if string(r.Owner) != owner || runTerminal(r.Status) {
+			continue
+		}
+		out = append(out, r)
+	}
+	sort.SliceStable(out, func(i, j int) bool { return out[i].CreatedAt.After(out[j].CreatedAt) })
+	if len(out) > cancelCandidateLimit {
+		out = out[:cancelCandidateLimit]
+	}
+	return out
+}
+
+func runTerminal(status core.RunStatus) bool {
+	switch status {
+	case core.RunCompleted, core.RunFailed, core.RunCancelled, core.RunInterrupted:
+		return true
+	}
+	return false
+}
+
+// handleIntentCancel 派发一次取消意图（靶子已唯一且可见）。响应形态与既有
+// 命令入口同源：消息落库后派发，回执/确认卡/如实回话都在响应里。
+func (s *Server) handleIntentCancel(w http.ResponseWriter, r *http.Request, conv core.Conversation,
+	msg core.Message, target *route.CancelTarget, runID string) {
+	owner := s.owner(r)
+	result := intentCancelResult{RunID: runID, Source: string(target.Source),
+		Intent: target.Intent, Action: target.Action}
+	out := map[string]any{"message": msg}
+	awaitingConfirm := false
+	switch {
+	case s.Bus != nil && s.Bus.HasCommand(intentCancelCommandID):
+		// 已注册取消命令：走与任何其他业务动作完全相同的分发路径。高危档
+		// 在这里会拿到内联确认卡并返回 accepted（awaiting explicit confirm），
+		// 确认前处理器不执行——绝不自动确认。
+		resp := s.Bus.Dispatch(r.Context(), cmdbus.Request{
+			ID:     intentCancelCommandID,
+			Params: map[string]any{intentCancelParam: runID, chatTextParam: strings.TrimSpace(messageText(msg))},
+			// chat 入口的规范 Entrance；Actor 是发起人，Owner 是归属租户。
+			Entrance: "chat", Actor: owner, Owner: owner, ConversationID: conv.ID,
+			AnchorMessageID: msg.ID, HostProjectID: string(conv.ProjectID),
+		})
+		result.Via, result.Accepted = "bus", resp.Receipt.State != agentcommand.StateRejected
+		awaitingConfirm = resp.Card != nil
+		out["command"], out["receipt"] = intentCancelCommandID, resp.Receipt
+		if resp.Card != nil {
+			out["card"] = resp.Card
+		}
+		if m, ok := resp.Payload.(map[string]any); ok {
+			for k, v := range m {
+				out[k] = v
+			}
+		}
+	default:
+		// 未注册取消命令：与 cancelRun 同款投递——PG 档且 run 不在本实例时
+		// 写持久命令由执行实例消费，否则就地级联取消本实例的句柄。
+		err := s.dispatchCancel(owner, runID)
+		result.Via = "local"
+		if s.st.Dialect() == "postgres" && !s.mgr.RunActiveLocally(runID) {
+			result.Via = "command"
+		}
+		if err != nil {
+			result.Reason = err.Error()
+		} else {
+			result.Accepted = true
+		}
+	}
+	out["cancel"] = result
+	switch {
+	case !result.Accepted:
+		// 没有真的取消：不写会话记录，也不声称已取消（原因随 cancel 字段透出）。
+	case awaitingConfirm:
+		// 已提交、等待显式确认：尚未生效，因此不记「已取消」；确认后的收尾
+		// 走确认卡自带的路径。
+	default:
+		// 已派发的取消记回会话：清挂起预期，留短期「已取消某运行」记录。
+		out["intent_session"] = s.recordIntentCancel(conv, owner, result, target, runID)
+	}
+	writeJSON(w, http.StatusOK, out)
+}
+
+// dispatchCancel 派发一次取消（与 cancelRun 同一条路径）：跨实例投递走收件箱
+// 持久命令，本实例活跃时就地取消句柄。投递本身经 store 的账号围栏——别人的
+// 运行号在构造上不可投递。
+func (s *Server) dispatchCancel(owner, runID string) error {
+	if s.st.Dialect() == "postgres" && !s.mgr.RunActiveLocally(runID) {
+		return s.enqueueCancelCommand(owner, runID)
+	}
+	return s.mgr.CancelRun(runID)
+}
+
+// enqueueCancelCommand 是 cancelRun 与取消意图共用的投递入口：写一条持久
+// cancel 命令，由目标 run 的当前执行实例消费。
+func (s *Server) enqueueCancelCommand(owner, runID string) error {
+	return s.st.EnqueueCommandAccountChecked(owner, store.NewID("cmd"), "cancel", runID, 0,
+		runmgr.CancelCommandPayload{Owner: owner, RunID: runID}, s.Auth == nil || !s.Auth.Enabled)
+}
+
+// recordIntentCancel 把一次已派发的取消记回会话：清挂起预期，留一条短期
+// 「已取消某运行」记录，供紧接着的追问（如「确认取消」）如实回话。
+func (s *Server) recordIntentCancel(conv core.Conversation, owner string,
+	result intentCancelResult, target *route.CancelTarget, runID string) *intentSessionNote {
+	reply := "已取消运行 " + runID + "。"
+	if result.Via == "command" {
+		// 跨实例投递：取消由目标 run 的执行实例收尾，这里只如实说「已提交」。
+		reply = "已提交取消运行 " + runID + "（由执行实例处理）。"
+	}
+	note := &intentSessionNote{Kind: "cancelled", Intent: target.Intent, Action: target.Action,
+		RunID: runID, Reply: reply}
+	svc := s.intentSessionService()
+	key := intentSessionKey(owner, conv)
+	if svc == nil || !keyUsable(key) {
+		return note
+	}
+	if _, err := svc.RecordCancel(key, intentsession.Binding{
+		RunID: runID, Intent: target.Intent, Action: target.Action}); err != nil {
+		// 记录失败不改变已发生的取消；回话仍如实说明取消了哪个运行。
+		note.Reply += "（会话记录未更新）"
+	}
+	return note
+}

internal/server/intent_cancel_test.go

@@ -0,0 +1,434 @@
+package server
+
+// A1/U-A1c 取消路由的 chat 端到端（合成数据 + 现有 fakes）：
+//   - 会话里绑定了一个活跃运行 → 无澄清地按既有取消路径派发（回执可见），
+//     并在会话上留下「已取消某运行」的短期记录；
+//   - 原文点名了运行 → 点名优先于会话绑定；
+//   - 靶子缺失/不可见 → 如实澄清并列出自己最近的运行，绝不猜；
+//   - 高危取消命令 → 仍先出确认卡，确认前不执行（会话不绕过确认门禁）。
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/intentgate"
+	"agent-system-backend/internal/intentsession"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+// taskCancelIntent 是「取消刚才的任务」的一次识别（库层 cancel 命令；与
+// U-A1b 的「取消运行 <id>」是不同意图：前者取消运行，后者放弃补槽）。
+func taskCancelIntent(slots map[string]string) intentgate.MatchResult {
+	return intentgate.MatchResult{Branch: "matched", ID: "demo.task-cancel", Slots: slots,
+		Commands: []intentgate.Command{{Kind: intentgate.CommandCancel, Target: "demo.task-cancel"}}}
+}
+
+// liveRun 起一个仍在进行的运行（mock runner 的 #hitl 挂起等待审批），返回
+// run id；它一直活到被取消或被审批——就是「我刚才的任务」。
+func liveRun(t *testing.T, h http.Handler, convID string) string {
+	t.Helper()
+	runID := postMessage(t, h, convID, "#hitl")
+	waitActiveHITL(t, h, convID)
+	return runID
+}
+
+// waitActiveHITL 等到运行挂起在审批上（run 处于活跃/等待态）。
+func waitActiveHITL(t *testing.T, h http.Handler, convID string) {
+	t.Helper()
+	deadline := time.Now().Add(testRunTerminalTimeout)
+	for time.Now().Before(deadline) {
+		if code, d := doJSON(t, h, "GET", "/api/conversations/"+convID, nil); code == 200 {
+			if cards, ok := d["activeHitl"].([]any); ok && len(cards) > 0 {
+				return
+			}
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	t.Fatal("运行没有进入等待审批状态")
+}
+
+// waitRunStatus 等运行落到期望状态（取消是异步收尾的）。
+func waitRunStatus(t *testing.T, h http.Handler, runID, want string) map[string]any {
+	t.Helper()
+	deadline := time.Now().Add(testRunTerminalTimeout)
+	for time.Now().Before(deadline) {
+		if code, d := doJSON(t, h, "GET", "/api/runs/"+runID, nil); code == 200 {
+			if r, ok := d["run"].(map[string]any); ok && r["status"] == want {
+				return r
+			}
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	t.Fatalf("运行 %s 未到达状态 %s", runID, want)
+	return nil
+}
+
+// seedBoundRun 在会话上挂起一个已抽到运行号的预期（等价于「上一轮澄清里
+// 抽到了这个运行」），用于驱动取消的会话来源。
+func seedBoundRun(t *testing.T, st *store.Store, projectID, convID, runID string) {
+	t.Helper()
+	_, err := intentsession.New(st).Suspend(intentsession.Key{
+		Owner: store.OwnerDefault, Project: projectID, Conversation: convID},
+		intentsession.Expectation{IntentID: "demo.run-cancel",
+			Action:   intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: "demo.run-cancel"},
+			Missing:  []intentgate.SlotQuestion{{Key: "reason", Question: "取消原因？"}},
+			Question: "取消原因？"},
+		map[string]string{"run_id": runID})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+// 会话里绑定了活跃运行 → 无澄清地派发既有取消动作（回执可见、运行真的停了）。
+func TestIntentCancelDispatchesRunBoundInSession(t *testing.T) {
+	srv, st, gate, _ := cancelServer(t)
+	h := srv.Handler()
+	projectID, convID := setupConversation(t, h)
+	runID := liveRun(t, h, convID)
+	seedBoundRun(t, st, projectID, convID, runID)
+	gate.script("取消刚才的任务", taskCancelIntent(nil))
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消刚才的任务"})
+	if code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	if _, asked := out["clarify"]; asked {
+		t.Fatalf("有唯一靶子时不得澄清：%v", out)
+	}
+	cancel, _ := out["cancel"].(map[string]any)
+	if cancel == nil || cancel["runId"] != runID || cancel["accepted"] != true || cancel["source"] != "session" {
+		t.Fatalf("取消回执：%v", out)
+	}
+	if _, ran := out["run"]; ran {
+		t.Fatalf("取消轮不得再起一个回合：%v", out)
+	}
+	note, _ := out["intent_session"].(map[string]any)
+	if note == nil || note["kind"] != "cancelled" || note["runId"] != runID || note["pending"] != false {
+		t.Fatalf("会话回话：%v", out)
+	}
+	// 派发真的生效：运行被取消。
+	waitRunStatus(t, h, runID, string(core.RunCancelled))
+
+	// 会话上留下短期「已取消」记录：挂起预期已清、记录指向被取消的运行。
+	sess := pendingIntent(t, st, projectID, convID)
+	if sess == nil || sess.Cancelled == nil || sess.Cancelled.RunID != runID {
+		t.Fatalf("取消记录：%+v", sess)
+	}
+	if len(sess.Expectation.Missing) != 0 || sess.Slots["run_id"] != "" {
+		t.Fatalf("取消后仍留着待补齐的槽位：%+v", sess)
+	}
+}
+
+// 原文点名的运行优先于会话绑定：被点的那个被取消，会话绑定的那个纹丝不动。
+func TestIntentCancelExplicitRunIDWinsOverSessionBinding(t *testing.T) {
+	srv, st, gate, _ := cancelServer(t)
+	h := srv.Handler()
+	projectID, _ := setupConversation(t, h)
+	// 两个会话各起一个活跃运行（同一用户、同一项目）。
+	boundConv := mustCode(t, h, "POST", "/api/projects/"+projectID+"/conversations",
+		map[string]any{"title": "另一个会话"})["id"].(string)
+	boundRun := liveRun(t, h, boundConv)
+	_, convID := setupConversation(t, h)
+	target := liveRun(t, h, convID)
+	seedBoundRun(t, st, projectID, convID, boundRun)
+	gate.script("取消刚才的任务 编号："+target, taskCancelIntent(map[string]string{"run_id": target}))
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消刚才的任务 编号：" + target})
+	if code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	cancel, _ := out["cancel"].(map[string]any)
+	if cancel == nil || cancel["runId"] != target || cancel["source"] != "explicit" || cancel["accepted"] != true {
+		t.Fatalf("显式运行号必须优先：%v", out)
+	}
+	waitRunStatus(t, h, target, string(core.RunCancelled))
+	if code, out := doJSON(t, h, "GET", "/api/runs/"+boundRun, nil); code == 200 {
+		if r, _ := out["run"].(map[string]any); r["status"] == string(core.RunCancelled) {
+			t.Fatalf("会话绑定的运行被误取消：%v", r)
+		}
+	}
+}
+
+// insertRun 写入一条合成运行行（未在本地执行的运行：候选与可见性用）。
+func insertRun(t *testing.T, st *store.Store, id, convID, projectID, owner, status string, age time.Duration) {
+	t.Helper()
+	if _, err := st.DB().Exec(`INSERT INTO runs
+		(id,parent_run_id,conversation_id,project_id,owner,kind,profile_id,status,phase,agent_name,created_at)
+		VALUES (?,'',?,?,?,'conversation','',?,'','',?)`,
+		id, convID, projectID, owner, status, time.Now().UTC().Add(-age).Format(time.RFC3339Nano)); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// 靶子不唯一：不猜。如实澄清，并把发起人自己最近的运行列出来（新到旧）。
+func TestIntentCancelWithoutTargetClarifiesWithOwnRuns(t *testing.T) {
+	srv, st, gate, _ := cancelServer(t)
+	h := srv.Handler()
+	projectID, convID := setupConversation(t, h)
+	// 会话里三条未终态运行：两条自己的、一条别人的（后者不得出现在候选里）。
+	insertRun(t, st, "run_old", convID, projectID, store.OwnerDefault, "running", 2*time.Minute)
+	insertRun(t, st, "run_new", convID, projectID, store.OwnerDefault, "waiting_hitl", 1*time.Minute)
+	insertRun(t, st, "run_foreign", convID, projectID, "mallory", "running", 30*time.Second)
+	insertRun(t, st, "run_done", convID, projectID, store.OwnerDefault, string(core.RunCompleted), 10*time.Second)
+	gate.script("取消刚才的任务", taskCancelIntent(nil))
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消刚才的任务"})
+	if code != 200 {
+		t.Fatalf("澄清轮：%d %v", code, out)
+	}
+	if _, dispatched := out["cancel"]; dispatched {
+		t.Fatalf("没有唯一靶子时不得派发：%v", out)
+	}
+	c := clarifyOf(t, out)
+	if c["question"] != "要取消哪一个任务？" {
+		t.Fatalf("澄清提问：%v", c)
+	}
+	missing, _ := c["missing"].([]any)
+	got := []string{}
+	for _, m := range missing {
+		got = append(got, m.(map[string]any)["key"].(string))
+	}
+	if strings.Join(got, ",") != "run_new,run_old" {
+		t.Fatalf("候选必须是自己最近的未终态运行（新到旧）：%v", got)
+	}
+	settle(t, h, out)
+	// 澄清不是取消：候选运行的状态一动不动（自己的可见，别人的依旧不可见）。
+	for _, id := range []string{"run_old", "run_new"} {
+		if _, err := st.GetRun(store.OwnerDefault, id); err != nil {
+			t.Fatalf("澄清轮改动了运行 %s：%v", id, err)
+		}
+	}
+	if _, err := st.GetRun("mallory", "run_foreign"); err != nil {
+		t.Fatalf("澄清轮改动了别人的运行：%v", err)
+	}
+
+	// 一个可取消的运行都没有时如实说明，而不是空问一句。
+	_, idle := setupConversation(t, h)
+	gate.script("取消任务", taskCancelIntent(nil))
+	code, out = doJSON(t, h, "POST", "/api/conversations/"+idle+"/messages",
+		map[string]any{"text": "取消任务"})
+	if code != 200 {
+		t.Fatalf("无候选轮：%d %v", code, out)
+	}
+	if q := clarifyOf(t, out)["question"]; q != "现在没有可取消的任务。" {
+		t.Fatalf("无候选时的提问：%v", q)
+	}
+	settle(t, h, out)
+}
+
+// 别人的运行既不可见也不可取消：不派发、不泄露存在性。
+func TestIntentCancelNeverResolvesAnotherOwnerRun(t *testing.T) {
+	srv, st, gate, _ := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	foreign := "run_foreign"
+	insertRun(t, st, foreign, convID, "prj_foreign", "mallory", "running", time.Minute)
+	if _, err := st.GetRun("mallory", foreign); err != nil {
+		t.Fatalf("前置：别人的运行应存在：%v", err)
+	}
+	gate.script("取消别人的任务", taskCancelIntent(map[string]string{"run_id": foreign}))
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消别人的任务"})
+	if code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	if _, dispatched := out["cancel"]; dispatched {
+		t.Fatalf("别人的运行不得被取消：%v", out)
+	}
+	c := clarifyOf(t, out)
+	if reason, _ := c["reason"].(string); !strings.Contains(reason, "不可见") {
+		t.Fatalf("应如实说明不可见（与不存在同一出口）：%v", c)
+	}
+	if missing, _ := c["missing"].([]any); len(missing) != 0 {
+		t.Fatalf("不得把别人的运行列为候选：%v", c)
+	}
+	settle(t, h, out)
+	if _, err := st.GetRun("mallory", foreign); err != nil {
+		t.Fatalf("别人的运行被改动了：%v", err)
+	}
+}
+
+// 确认语义不变：注册了高危取消命令时先出确认卡，确认前处理器不执行；
+// 确认后才真的派发。会话不记录「已取消」（尚未生效）。
+func TestIntentCancelSurfacesHighDangerConfirmCard(t *testing.T) {
+	srv, st, gate, log := cancelServer(t)
+	h := srv.Handler()
+	projectID, convID := setupConversation(t, h)
+	runID := liveRun(t, h, convID)
+	risky := agentcommand.CommandSpec{ID: intentCancelCommandID, Title: "取消运行（高危）",
+		Danger: agentcommand.DangerHigh,
+		ParamsSchema: json.RawMessage(`{"type":"object","required":["text","run_id"],
+			"properties":{"run_id":{"type":"string"},"text":{"type":"string"}}}`)}
+	if err := srv.Bus.RegisterBuiltin(risky, "", func(_ context.Context, req cmdbus.Request) (any, error) {
+		log.record(req)
+		return map[string]any{"ok": true}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	gate.script("取消刚才的任务", taskCancelIntent(map[string]string{"run_id": runID}))
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消刚才的任务"})
+	if code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	if out["command"] != intentCancelCommandID {
+		t.Fatalf("注册了取消命令时应走命令总线：%v", out)
+	}
+	receipt, _ := out["receipt"].(map[string]any)
+	if receipt == nil || receipt["state"] != string(agentcommand.StateAccepted) {
+		t.Fatalf("高危命令的受理回执：%v", out)
+	}
+	card, _ := out["card"].(map[string]any)
+	if card == nil {
+		t.Fatalf("高危取消必须出确认卡：%v", out)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("确认前不得执行处理器：%v", log.snapshot())
+	}
+	if _, noted := out["intent_session"]; noted {
+		t.Fatalf("确认前不得在会话上记「已取消」：%v", out)
+	}
+	if sess := pendingIntent(t, st, projectID, convID); sess != nil {
+		t.Fatalf("确认前会话不得被改写：%+v", sess)
+	}
+
+	// 卡上确认 → 与任何其他高后果命令同款：处理器执行，参数带运行号。
+	cardID, _ := card["id"].(string)
+	code, confirmed := doJSON(t, h, "POST", "/api/cards/"+cardID+"/actions/confirm", map[string]any{})
+	if code != 200 {
+		t.Fatalf("确认：%d %v", code, confirmed)
+	}
+	rec, _ := confirmed["receipt"].(map[string]any)
+	if rec == nil || rec["state"] != string(agentcommand.StateCommitted) {
+		t.Fatalf("确认回执：%v", confirmed)
+	}
+	calls := log.snapshot()
+	if len(calls) != 1 || calls[0]["run_id"] != runID || calls[0]["text"] != "取消刚才的任务" {
+		t.Fatalf("确认后的派发参数：%v", calls)
+	}
+}
+
+// 没有会话、也没有点名运行的历史行为逐字节不变：普通回合照常起，响应里既
+// 没有取消字段，也没有会话语义字段。
+func TestIntentCancelLegacyTurnUnchangedWithoutSession(t *testing.T) {
+	srv, _, gate, log := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	gate.script("今天天气如何", intentgate.MatchResult{Branch: "fallback"})
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "今天天气如何"})
+	if code != 200 {
+		t.Fatalf("普通轮：%d %v", code, out)
+	}
+	for _, key := range []string{"cancel", "clarify", "intent_session", "command"} {
+		if _, has := out[key]; has {
+			t.Fatalf("普通轮不应出现 %s：%v", key, out)
+		}
+	}
+	if _, ran := out["run"]; !ran {
+		t.Fatalf("普通轮照常起 run：%v", out)
+	}
+	settle(t, h, out)
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("普通轮不得派发命令：%v", log.snapshot())
+	}
+}
+
+// 会话上的「已取消」记录不再是取消的靶子：重复取消如实回到澄清。
+func TestIntentCancelRecordIsNotACancelTarget(t *testing.T) {
+	srv, st, gate, _ := cancelServer(t)
+	h := srv.Handler()
+	projectID, convID := setupConversation(t, h)
+	runID := liveRun(t, h, convID)
+	seedBoundRun(t, st, projectID, convID, runID)
+	gate.script("取消刚才的任务", taskCancelIntent(nil))
+	if code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消刚才的任务"}); code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	waitRunStatus(t, h, runID, string(core.RunCancelled))
+	gate.script("再取消一次", taskCancelIntent(nil))
+	// 第二轮是占槽位的澄清回合：等上一轮被取消的运行彻底收工再发车（忙 409 是
+	// 既有语义，见 postConversationTurn）。
+	code, out := postConversationTurn(t, srv, h, st, convID, "再取消一次")
+	if code != 200 {
+		t.Fatalf("第二轮取消：%d %v", code, out)
+	}
+	if _, dispatched := out["cancel"]; dispatched {
+		t.Fatalf("已取消的记录不得再当靶子：%v", out)
+	}
+	if _, kept := out["intent_session"]; kept {
+		t.Fatalf("澄清轮不得改写会话记录：%v", out)
+	}
+	settle(t, h, out)
+}
+
+// 命令值里的运行号（库层 cancel 命令自带 value）同样能解出靶子。
+func TestIntentCancelResolvesRunIDFromCommandValue(t *testing.T) {
+	srv, _, gate, _ := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	runID := liveRun(t, h, convID)
+	withValue := taskCancelIntent(nil)
+	withValue.Commands[0].Value = runID
+	gate.script("取消那个", withValue)
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消那个"})
+	if code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	cancel, _ := out["cancel"].(map[string]any)
+	if cancel == nil || cancel["runId"] != runID || cancel["accepted"] != true {
+		t.Fatalf("命令值里的运行号未解出：%v", out)
+	}
+	waitRunStatus(t, h, runID, string(core.RunCancelled))
+}
+
+// 消息原文进 params：取消命令与其它命令入口同款（恒带 text）。
+func TestIntentCancelPassesOriginalText(t *testing.T) {
+	srv, _, gate, log := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	runID := liveRun(t, h, convID)
+	if err := srv.Bus.RegisterBuiltin(agentcommand.CommandSpec{ID: intentCancelCommandID,
+		Title: "取消运行", ParamsSchema: json.RawMessage(`{"type":"object","required":["text","run_id"],
+			"properties":{"run_id":{"type":"string"},"text":{"type":"string"}}}`)},
+		"", func(_ context.Context, req cmdbus.Request) (any, error) {
+			log.record(req)
+			raw, _ := json.Marshal(req)
+			if !strings.Contains(string(raw), `"Entrance":"chat"`) {
+				t.Errorf("Entrance 必须归一为 chat：%s", raw)
+			}
+			if req.Actor == "" || req.Owner == "" {
+				t.Errorf("Actor/Owner 必须是发起人：%+v", req)
+			}
+			return map[string]any{"ok": true}, nil
+		}); err != nil {
+		t.Fatal(err)
+	}
+	gate.script("取消刚才的任务", taskCancelIntent(map[string]string{"run_id": runID}))
+
+	code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages",
+		map[string]any{"text": "取消刚才的任务"})
+	if code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	calls := log.snapshot()
+	if len(calls) != 1 || calls[0]["run_id"] != runID || calls[0]["text"] != "取消刚才的任务" {
+		t.Fatalf("派发参数：%v", calls)
+	}
+}

internal/server/intent_session.go

@@ -0,0 +1,328 @@
+package server
+
+// 意图会话语义（A1/U-A1b）：chat 入口消费库层的会话命令（set_slot/
+// change_slot/cancel/expectation），把「动作可执行但槽位未就绪」的那一轮
+// 记成会话里的挂起预期，等用户后续轮次把槽位补齐。
+//
+// 纪律：
+//   - 补齐后走的是与一次完整识别完全相同的 route.Decide + admitIntentCommand
+//     + Bus.Dispatch 路径；会话只携带槽位与预期，绝不携带授权——高危动作
+//     的确认仍由 cmdbus 收口。
+//   - 没有挂起预期时本段整体空转：响应逐字节与既有行为一致。
+//   - 取消分两件事，宿主如实区分，绝不混为一谈：
+//     · 「放弃本次补充」（会话语义）：cancel 命令 + 有挂起预期 + 解不出要
+//       取消的运行 → 清预期并如实确认，不派发任何业务动作；
+//     · 「取消一个运行」（业务动作，A1/U-A1c）：解出了唯一靶子 → 走既有
+//       取消路径派发，见 intent_cancel.go。
+//     两者都不会绕过 cmdbus 的确认收口。
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"agent-system-backend/internal/intentgate"
+	"agent-system-backend/internal/intentsession"
+	"agent-system-backend/internal/route"
+	core "agent-system-core"
+)
+
+// IntentSessions 是意图会话的宿主消费面（intentsession.Service 的端口）。
+// 组合根/测试可注入替身；nil 时按存储自动装配。
+type IntentSessions interface {
+	Pending(intentsession.Key) (*intentsession.Session, error)
+	Suspend(intentsession.Key, intentsession.Expectation, map[string]string) (*intentsession.Session, error)
+	ApplyAnswer(intentsession.Key, int, intentsession.Answer) (*intentsession.Outcome, error)
+	ApplyCommand(intentsession.Key, int, string, string, string) (*intentsession.Outcome, error)
+	Drop(intentsession.Key) error
+	Binding(intentsession.Key) (*intentsession.Binding, error)
+	RecordCancel(intentsession.Key, intentsession.Binding) (*intentsession.Session, error)
+}
+
+// SetIntentSessionService 注入意图会话服务（组合根与测试用；nil 回落按存储
+// 自动装配）。
+func (s *Server) SetIntentSessionService(svc IntentSessions) {
+	s.sessionsMu.Lock()
+	defer s.sessionsMu.Unlock()
+	s.sessions = svc
+}
+
+// intentSessionService 取会话服务：未注入时从存储惰性装配一次，并把槽位
+// 校验接到命令总线的 DECLARED schema 上。
+func (s *Server) intentSessionService() IntentSessions {
+	s.sessionsMu.Lock()
+	defer s.sessionsMu.Unlock()
+	if s.sessions == nil && s.st != nil {
+		svc := intentsession.New(s.st)
+		svc.SetSlotValidator(s.validateIntentSlot)
+		s.sessions = svc
+	}
+	return s.sessions
+}
+
+// intentSessionKey 是会话状态的键：owner + project + conversation（三元组
+// 缺一不可，两个用户/项目在构造上互不可见）。
+func intentSessionKey(owner string, conv core.Conversation) intentsession.Key {
+	return intentsession.Key{Owner: owner, Project: string(conv.ProjectID), Conversation: string(conv.ID)}
+}
+
+// validateIntentSlot 按动作声明的 schema 校验一个槽位值：声明不可解析
+// （命令不存在/未启用）时不校验，交由既有准入面 fail-closed。
+func (s *Server) validateIntentSlot(actionID, slot, value string) error {
+	if s.Bus == nil || actionID == "" {
+		return nil
+	}
+	spec, _, err := s.Bus.Registry().Resolve(actionID)
+	if err != nil {
+		return nil
+	}
+	props, _, ok := objectSchema(spec.ParamsSchema)
+	if !ok {
+		return nil
+	}
+	decl, declared := props[slot]
+	if !declared {
+		return fmt.Errorf("命令未声明参数：%s", slot)
+	}
+	if _, ok := castParam(decl, value); !ok {
+		return fmt.Errorf("参数类型与声明不符：%s", slot)
+	}
+	return nil
+}
+
+// intentSessionOutcome 是本轮会话语义的结果，供响应面如实回话。
+type intentSessionOutcome struct {
+	// cancelled 表示用户取消了挂起的补充（不派发任何业务动作）。
+	cancelled bool
+	// clarify 是仍缺槽位时的澄清诉求（仍缺时才非空）。
+	clarify *clarifyPayload
+	// note 是取消这类「不需要派发」的如实回话。
+	note *intentSessionNote
+}
+
+// intentSessionNote 是会话语义的回话标记（既有响应上的附加字段，不新增 API 面）。
+type intentSessionNote struct {
+	Kind    string `json:"kind"`
+	Action  string `json:"action,omitempty"`
+	Intent  string `json:"intent,omitempty"`
+	RunID   string `json:"runId,omitempty"`
+	Reply   string `json:"reply"`
+	Pending bool   `json:"pending"`
+}
+
+// fuseIntentSession 把本轮用户输入折叠进挂起预期：补齐即合成一条与完整
+// 识别同形的 MatchResult（下游照常 route → admit → dispatch）；仍缺则
+// 如实重新澄清；取消则清理会话且不派发。
+// 返回 nil 结果表示本轮与会话语义无关（无挂起预期、或属于别的任务），
+// 调用方保持既有行为。
+func (s *Server) fuseIntentSession(key intentsession.Key,
+	recognized intentgate.MatchResult) (intentgate.MatchResult, *intentSessionOutcome, error) {
+	svc := s.intentSessionService()
+	if svc == nil || !keyUsable(key) {
+		return recognized, nil, nil
+	}
+	pending, err := svc.Pending(key)
+	if err != nil {
+		return recognized, nil, err
+	}
+	// 「已取消」记录不是待补齐的动作：它不再吸收本轮的槽位补充（那一轮由
+	// 取消路由自己处理），只作为如实回话的依据。
+	if pending == nil || pending.Expectation == nil || pending.Cancelled != nil {
+		return recognized, nil, nil
+	}
+	answer := answerFromRecognition(pending, recognized)
+	if answer.Cancel {
+		return recognized, s.applyCancel(svc, key, pending, answer), nil
+	}
+	// 本轮对同一动作已是一次完整的新识别：它就是新的指令，按它派发；
+	// 旧累计槽位不混进新任务（会话就此作废）。
+	if recognized.Branch == "matched" && recognized.ID != "" &&
+		recognized.ID == pending.Expectation.IntentID && recognized.Complete() {
+		return recognized, nil, svc.Drop(key)
+	}
+	if len(answer.Slots) == 0 && len(answer.Invalid) == 0 {
+		// 本轮没有补槽信息（含「命中的是别的意图」）：保持既有行为，挂起预期
+		// 原样留着，由续期或过期收尾——绝不拿别的任务的输入凑当前动作。
+		return recognized, nil, nil
+	}
+	out, err := svc.ApplyAnswer(key, pending.Revision, answer)
+	if errors.Is(err, intentsession.ErrStale) {
+		// 会话已被别的轮次推进或取消：陈旧回答作废，绝不据此执行动作。
+		return recognized, nil, nil
+	}
+	if err != nil || out == nil {
+		return recognized, nil, err
+	}
+	if out.Complete {
+		// 补齐：recognized 已是与完整识别同形的结果，直接走既有准入与
+		// 派发路径（无需任何附加回话字段）。
+		return completedRecognition(pending, out), &intentSessionOutcome{}, nil
+	}
+	return recognized, &intentSessionOutcome{clarify: sessionClarify(pending, out)}, nil
+}
+
+// applyCancel 消费库层 cancel：清空挂起预期并如实确认取消（不派发业务动作）。
+func (s *Server) applyCancel(svc IntentSessions, key intentsession.Key,
+	pending *intentsession.Session, answer intentsession.Answer) *intentSessionOutcome {
+	out, err := svc.ApplyAnswer(key, pending.Revision, answer)
+	if errors.Is(err, intentsession.ErrStale) || err != nil || out == nil || !out.Cancelled {
+		return nil
+	}
+	action, intent := "", pending.Expectation.IntentID
+	if pending.Expectation.Action.ID != "" {
+		action = pending.Expectation.Action.ID
+	}
+	return &intentSessionOutcome{
+		cancelled: true,
+		note: &intentSessionNote{Kind: "cancelled", Action: action, Intent: intent, Pending: false,
+			Reply: "已取消本次槽位补充，未执行任何动作。"},
+	}
+}
+
+// answerFromRecognition 把一次识别投影成会话语义的答案：库层会话命令
+// （cancel 优先）、挂起意图自身的槽位与非法原因。归属别的意图时一概不碰
+// 本会话（别的任务的输入绝不混进当前动作）。
+func answerFromRecognition(pending *intentsession.Session, recognized intentgate.MatchResult) intentsession.Answer {
+	answer := intentsession.Answer{}
+	sameIntent := recognized.ID != "" && recognized.ID == pending.Expectation.IntentID
+	otherIntent := recognized.ID != "" && !sameIntent
+	for _, cmd := range recognized.Commands {
+		switch cmd.Kind {
+		case intentgate.CommandCancel:
+			if !otherIntent { // 取消指向别的意图时不碰本会话
+				answer.Cancel = true
+				return answer
+			}
+		case intentgate.CommandSetSlot, intentgate.CommandChangeSlot:
+			if strings.TrimSpace(cmd.Name) == "" {
+				continue
+			}
+			if answer.Slots == nil {
+				answer.Slots = map[string]string{}
+			}
+			answer.Slots[cmd.Name] = cmd.Value // 显式落槽命令：不看意图归属
+		}
+	}
+	if !sameIntent {
+		return answer
+	}
+	if len(recognized.Slots) > 0 {
+		if answer.Slots == nil {
+			answer.Slots = make(map[string]string, len(recognized.Slots))
+		}
+		for k, v := range recognized.Slots {
+			answer.Slots[k] = v
+		}
+	}
+	for _, defect := range recognized.Invalid {
+		if answer.Invalid == nil {
+			answer.Invalid = map[string]string{}
+		}
+		answer.Invalid[defect.Key] = firstNonEmpty(defect.Reason, "value rejected")
+	}
+	return answer
+}
+
+// completedRecognition 合成一条与「一次完整识别」同形的 MatchResult：同一
+// 意图 ID、累计槽位、同一动作引用的 Start 命令。风险与确认声明刻意不搬运
+// ——会话不携带授权语义，确认始终由 cmdbus 按命令 danger 收口。
+func completedRecognition(pending *intentsession.Session, out *intentsession.Outcome) intentgate.MatchResult {
+	action := pending.Expectation.Action
+	res := intentgate.MatchResult{
+		Branch:   "matched",
+		ID:       pending.Expectation.IntentID,
+		Slots:    out.Slots,
+		Commands: []intentgate.Command{{Kind: intentgate.CommandStart, Action: action, Slots: out.Slots}},
+	}
+	if action.ID != "" {
+		ref := action
+		res.Action = &ref
+	}
+	return res
+}
+
+// sessionClarify 仍缺槽位时的澄清诉求：只报还差什么（缺失/非法各带原因）。
+func sessionClarify(pending *intentsession.Session, out *intentsession.Outcome) *clarifyPayload {
+	action, intent := "", pending.Expectation.IntentID
+	if pending.Expectation.Action.ID != "" {
+		action = pending.Expectation.Action.ID
+	}
+	// 提问优先问「还差的那个」：缺失在前、非法在后，都没有才回落挂起时的
+	// 原始提问。
+	question := ""
+	if len(out.Remaining) > 0 {
+		question = strings.TrimSpace(out.Remaining[0].Question)
+	} else if len(out.Invalid) > 0 {
+		question = strings.TrimSpace(out.Invalid[0].Question)
+	}
+	if question == "" {
+		question = strings.TrimSpace(out.Question)
+	}
+	c := &clarifyPayload{Intent: intent, Command: action, Question: question,
+		Missing: append([]intentgate.SlotQuestion(nil), out.Remaining...),
+		Invalid: append([]intentgate.SlotDefect(nil), out.Invalid...)}
+	if c.Question == "" {
+		return nil
+	}
+	return c
+}
+
+// suspendIntentSession 把「动作可执行但槽位未就绪」的那一轮记成会话里的
+// 挂起预期（U6 准入面：声明的必填参数无法由原文+槽位满足；路由面：缺失或
+// 非法的必填槽位）。响应面不受影响——澄清话术仍由既有 clarify 字段给出。
+func (s *Server) suspendIntentSession(key intentsession.Key, recognized intentgate.MatchResult,
+	dec route.Decision, adm *intentAdmission) error {
+	svc := s.intentSessionService()
+	if svc == nil || !keyUsable(key) {
+		return nil
+	}
+	commandID := dec.Clarification.Command
+	var missing []intentgate.SlotQuestion
+	question := strings.TrimSpace(dec.Clarification.Question)
+	switch {
+	case dec.Kind == route.KindCommand && adm != nil && adm.Blocked:
+		// 路由已认为动作可派发，但准入未过（声明的必填参数补不齐）。
+		commandID = dec.CommandID
+		for _, name := range adm.MissingParams {
+			missing = append(missing, intentgate.SlotQuestion{Key: name, Question: name})
+		}
+	case dec.Clarification.Needed && commandID != "":
+		// 路由层槽位缺口/非法：动作已解析到已存在的命令，只是槽位不齐。
+		missing = append(missing, dec.Clarification.Missing...)
+		for _, defect := range dec.Clarification.Invalid {
+			missing = append(missing, intentgate.SlotQuestion{Key: defect.Key, Question: defect.Question})
+		}
+	default:
+		return nil // 没有待补齐的可执行动作：不挂起
+	}
+	if commandID == "" {
+		return nil
+	}
+	if question == "" && len(missing) > 0 {
+		question = strings.TrimSpace(missing[0].Question)
+	}
+	_, err := svc.Suspend(key, intentsession.Expectation{
+		IntentID: recognized.ID,
+		Action:   intentgate.ActionRef{Kind: intentgate.ActionCommand, ID: commandID},
+		Missing:  missing, Question: question,
+	}, dec.Slots)
+	return err
+}
+
+// keyUsable 拒绝不完整的键（无归属即不落任何会话状态）。
+func keyUsable(key intentsession.Key) bool { return key.Owner != "" && key.Conversation != "" }
+
+// sessionRunTarget 把意图会话里绑定的运行上下文投影给路由器（取消靶子的
+// 会话来源）。没有绑定、绑定已取消、或读取失败一律返回 false：宿主随即
+// 如实澄清，绝不臆造一个靶子。
+func (s *Server) sessionRunTarget(key intentsession.Key) (route.SessionRun, bool) {
+	svc := s.intentSessionService()
+	if svc == nil || !keyUsable(key) {
+		return route.SessionRun{}, false
+	}
+	b, err := svc.Binding(key)
+	if err != nil || b == nil || b.Cancelled || strings.TrimSpace(b.RunID) == "" {
+		return route.SessionRun{}, false
+	}
+	return route.SessionRun{RunID: b.RunID, Intent: b.Intent, Action: b.Action}, true
+}

internal/server/intent_session_test.go

@@ -0,0 +1,676 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/intentgate"
+	"agent-system-backend/internal/intentsession"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+// A1/U-A1b 会话语义的 chat 端到端（合成数据 + 现有 fakes）：缺槽位动作先
+// 澄清挂起，下一轮补齐后按同一条准入/派发路径执行；取消清理会话；过期会话
+// 不影响任何新轮次。高危确认仍由 cmdbus 收口（会话只带槽位）。
+
+// scriptedGate 按输入文本返回脚本化的识别结果；未命中的输入走普通回合
+// （fallback）。这是库层识别的替身，不改 Stage-1 语义。
+type scriptedGate struct {
+	mu      sync.Mutex
+	results map[string]intentgate.MatchResult
+}
+
+func (g *scriptedGate) script(input string, res intentgate.MatchResult) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.results == nil {
+		g.results = map[string]intentgate.MatchResult{}
+	}
+	g.results[input] = res
+}
+
+func (g *scriptedGate) Recognize(_ context.Context, input string) intentgate.MatchResult {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	res, ok := g.results[input]
+	if !ok {
+		return intentgate.MatchResult{Branch: "fallback"}
+	}
+	return res
+}
+
+func (g *scriptedGate) Match(_ context.Context, input string) (string, string) {
+	res := g.Recognize(context.Background(), input)
+	return res.Branch, res.ID
+}
+
+// cancelStart 是「取消运行」动作的一次完整/不完整识别（run-cancel 形态）。
+func cancelStart(slots map[string]string, missing []intentgate.SlotQuestion) intentgate.MatchResult {
+	res := intentgate.MatchResult{
+		Branch: "matched", ID: "demo.run-cancel", Slots: slots, Missing: missing,
+		Commands: []intentgate.Command{{Kind: intentgate.CommandStart,
+			Action: intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: "demo.run-cancel"}, Slots: slots}},
+	}
+	if len(missing) > 0 {
+		res.Commands = append(res.Commands, intentgate.Command{Kind: intentgate.CommandClarify,
+			Question: missing[0].Question})
+	}
+	return res
+}
+
+// cancelAnswer 是「对挂起预期的回答」（库层 expectation_hit 分支的同形结果）。
+func cancelAnswer(slots map[string]string, missing []intentgate.SlotQuestion) intentgate.MatchResult {
+	res := intentgate.MatchResult{Branch: "expectation_hit", ID: "demo.run-cancel", Slots: slots, Missing: missing}
+	if len(missing) == 0 {
+		res.Commands = []intentgate.Command{{Kind: intentgate.CommandStart,
+			Action: intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: "demo.run-cancel"}, Slots: slots}}
+	}
+	return res
+}
+
+var cancelSpec = agentcommand.CommandSpec{ID: "demo.run-cancel", Title: "取消运行",
+	ParamsSchema: json.RawMessage(`{"type":"object","required":["text","run_id","reason"],
+		"properties":{"run_id":{"type":"string"},"reason":{"type":"string"}}}`)}
+
+// cancelServer 组装带脚本化意图闸门与 demo.run-cancel 命令的服务器。
+func cancelServer(t *testing.T) (*Server, *store.Store, *scriptedGate, *dispatchLog) {
+	t.Helper()
+	return cancelServerWith(t, cancelSpec)
+}
+
+// cancelServerWith 同上但命令声明可替换（同 id 只注册一次）。
+func cancelServerWith(t *testing.T, spec agentcommand.CommandSpec) (*Server, *store.Store, *scriptedGate, *dispatchLog) {
+	t.Helper()
+	srv, st := newTestServer(t)
+	log := &dispatchLog{}
+	if err := srv.Bus.RegisterBuiltin(spec, "", func(_ context.Context, req cmdbus.Request) (any, error) {
+		log.record(req)
+		return map[string]any{"ok": true}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	gate := &scriptedGate{}
+	srv.Gate = gate
+	return srv, st, gate, log
+}
+
+// settle 等本轮启动的回合落终态（会话槽位随即释放，便于下一轮）。
+func settle(t *testing.T, h http.Handler, out map[string]any) map[string]any {
+	t.Helper()
+	if run, ok := out["run"].(map[string]any); ok {
+		if id, _ := run["id"].(string); id != "" {
+			waitRunTerminal(t, h, id, testRunTerminalTimeout)
+		}
+	}
+	return out
+}
+
+// 会话忙（409）是既有语义，不改：占槽位的回合（普通回合、澄清回合）在忙时如
+// 实 409，意图命中的命令则不占槽位、会话忙时也能用。测试侧要解决的是「等发得
+// 出去」，而不是放宽断言：上一轮的 run 行在结算提交那一刻就终态了，槽位要到收
+// 尾（补锚点、发终态事件、摘执行句柄）之后才释放，机器繁忙时这段窗口会被放大，
+// 于是「run 一终态就立刻发下一轮」会偶发撞上忙 409。
+
+// postConversationTurn 发一轮消息：先等会话空闲（见 waitConversationIdle），
+// 发车时若仍撞上忙（409）则在「忙拒没有留下痕迹」的前提下按 deadline 重发。
+// 忙不写消息与运行，但抢槽位发生在意图会话折叠之后——被忙拒掉的轮次仍可能已经
+// 消费或挂起了会话，再发一次走的就是另一条路径了；所以每次重发前先比对意图会
+// 话状态：变过了就如实失败，没变过才重发。
+func postConversationTurn(t *testing.T, srv *Server, h http.Handler, st *store.Store,
+	convID, text string) (int, map[string]any) {
+	t.Helper()
+	waitConversationIdle(t, srv, h, convID)
+	deadline := time.Now().Add(testRunTerminalTimeout)
+	for {
+		before := intentSessionTrace(t, st, convID)
+		code, out := doJSON(t, h, "POST", "/api/conversations/"+convID+"/messages", map[string]any{"text": text})
+		if code != http.StatusConflict {
+			return code, out
+		}
+		if after := intentSessionTrace(t, st, convID); after != before {
+			t.Fatalf("%s：忙（409）之前已改动意图会话，重发会走另一条路径：%s → %s", text, before, after)
+		}
+		if !time.Now().Before(deadline) {
+			t.Fatalf("%s：会话持续忙（409）超过 %v：%v", text, testRunTerminalTimeout, out)
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+}
+
+// waitConversationIdle 等会话真正让出槽位：既没有未终态运行，也没有仍在本地
+// 执行的 run——执行句柄在槽位释放之后才摘除（runmgr 的 execute 收尾），所以
+// 「没有活跃句柄」就是槽位已空的可观测证据，不用赌收尾窗口有多宽。
+func waitConversationIdle(t *testing.T, srv *Server, h http.Handler, convID string) {
+	t.Helper()
+	deadline := time.Now().Add(testRunTerminalTimeout)
+	for time.Now().Before(deadline) {
+		if code, out := doJSON(t, h, "GET", "/api/conversations/"+convID, nil); code == 200 &&
+			!conversationHasOpenRun(out) && !conversationHasActiveRun(srv, out) {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("会话 %s 在 %v 内未空闲", convID, testRunTerminalTimeout)
+}
+
+// conversationHasOpenRun 看会话里是否还有未终态运行（结算尚未提交）。
+func conversationHasOpenRun(detail map[string]any) bool {
+	for _, run := range conversationRuns(detail) {
+		switch run["status"] {
+		case string(core.RunCompleted), string(core.RunFailed),
+			string(core.RunCancelled), string(core.RunInterrupted):
+		default:
+			return true
+		}
+	}
+	return false
+}
+
+// conversationHasActiveRun 看会话里是否还有本地在执行的 run（槽位未让出）。
+func conversationHasActiveRun(srv *Server, detail map[string]any) bool {
+	for _, run := range conversationRuns(detail) {
+		if id, _ := run["id"].(string); id != "" && srv.mgr.RunActiveLocally(id) {
+			return true
+		}
+	}
+	return false
+}
+
+func conversationRuns(detail map[string]any) []map[string]any {
+	raw, _ := detail["runs"].([]any)
+	runs := make([]map[string]any, 0, len(raw))
+	for _, item := range raw {
+		if run, ok := item.(map[string]any); ok {
+			runs = append(runs, run)
+		}
+	}
+	return runs
+}
+
+// intentSessionTrace 描述会话上当前的意图会话状态（忙拒前后各取一次比对）。
+func intentSessionTrace(t *testing.T, st *store.Store, convID string) string {
+	t.Helper()
+	conv, err := st.GetConversation(store.OwnerDefault, convID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sess, err := st.GetIntentSession(store.OwnerDefault, string(conv.ProjectID), convID)
+	if err == store.ErrNotFound {
+		return "none"
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	return fmt.Sprintf("rev=%d exp=%v slots=%v", sess.Revision, sess.Expectation, sess.Slots)
+}
+
+// 缺必填槽位 → 澄清并挂起；下一轮补齐 → 按同一条准入与派发路径执行。
+func TestIntentSessionAnswerCompletesPendingAction(t *testing.T) {
+	srv, st, gate, log := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	runIDQ := "取消哪个运行？"
+	gate.script("取消运行", cancelStart(nil, []intentgate.SlotQuestion{
+		{Key: "run_id", Question: runIDQ}, {Key: "reason", Question: "取消原因？"}}))
+
+	code, out := postConversationTurn(t, srv, h, st, convID, "取消运行")
+	if code != 200 {
+		t.Fatalf("第一轮：%d %v", code, out)
+	}
+	if _, executed := out["command"]; executed {
+		t.Fatalf("槽位未就绪不得派发业务动作：%v", out)
+	}
+	c := clarifyOf(t, out)
+	if c["command"] != "demo.run-cancel" || c["question"] != runIDQ {
+		t.Fatalf("澄清诉求：%v", c)
+	}
+	settle(t, h, out)
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("澄清轮不得派发：%v", log.snapshot())
+	}
+	pending := pendingIntent(t, st, "", convID)
+	if pending == nil || pending.Expectation.Action.ID != "demo.run-cancel" {
+		t.Fatalf("未挂起预期：%+v", pending)
+	}
+
+	// 下一轮：仅补齐槽位（库层挂起预期命中分支的同形结果）。
+	answerText := "编号：R-7 原因：误触发"
+	gate.script(answerText, cancelAnswer(map[string]string{"run_id": "R-7", "reason": "误触发"}, nil))
+	code, out = postConversationTurn(t, srv, h, st, convID, answerText)
+	if code != 200 || out["command"] != "demo.run-cancel" {
+		t.Fatalf("补齐后应派发同一动作：%d %v", code, out)
+	}
+	if _, hasClarify := out["clarify"]; hasClarify {
+		t.Fatalf("补齐后不应再澄清：%v", out)
+	}
+	calls := log.snapshot()
+	if len(calls) != 1 {
+		t.Fatalf("处理器调用次数：%d", len(calls))
+	}
+	params := calls[0]
+	if params["run_id"] != "R-7" || params["reason"] != "误触发" || params["text"] != answerText {
+		t.Fatalf("累计槽位未进派发参数：%v", params)
+	}
+	if pendingIntent(t, st, "", convID) != nil {
+		t.Fatal("补齐后会话应被消费")
+	}
+}
+
+// 两轮部分填充：先 set_slot 落一个槽位（仍缺 → 重新澄清），再由回答补齐。
+func TestIntentSessionSetSlotThenAnswerCompletes(t *testing.T) {
+	srv, st, gate, log := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	gate.script("取消运行", cancelStart(nil, []intentgate.SlotQuestion{
+		{Key: "run_id", Question: "取消哪个运行？"}, {Key: "reason", Question: "取消原因？"}}))
+	code, out := postConversationTurn(t, srv, h, st, convID, "取消运行")
+	if code != 200 {
+		t.Fatalf("第一轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+
+	// 第二轮：库层 set_slot（只带一个槽位），仍缺原因 → 如实重新澄清。
+	gate.script("编号 R-7", intentgate.MatchResult{Branch: "expectation_hit", ID: "demo.run-cancel",
+		Commands: []intentgate.Command{{Kind: intentgate.CommandSetSlot, Name: "run_id", Value: "R-7"}}})
+	code, out = postConversationTurn(t, srv, h, st, convID, "编号 R-7")
+	if code != 200 {
+		t.Fatalf("set_slot 轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	if _, executed := out["command"]; executed {
+		t.Fatalf("仍缺槽位不得派发：%v", out)
+	}
+	c := clarifyOf(t, out)
+	if c["question"] != "取消原因？" {
+		t.Fatalf("仍缺的提问：%v", c)
+	}
+	missing, _ := c["missing"].([]any)
+	if len(missing) != 1 || missing[0].(map[string]any)["key"] != "reason" {
+		t.Fatalf("仍缺清单：%v", c)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("部分填充不得派发：%v", log.snapshot())
+	}
+
+	// 第三轮：补上原因 → 派发，两个槽位都来自会话累计。
+	gate.script("原因：误触发", cancelAnswer(map[string]string{"reason": "误触发"}, nil))
+	code, out = postConversationTurn(t, srv, h, st, convID, "原因：误触发")
+	if code != 200 || out["command"] != "demo.run-cancel" {
+		t.Fatalf("补齐后应派发：%d %v", code, out)
+	}
+	calls := log.snapshot()
+	if len(calls) != 1 || calls[0]["run_id"] != "R-7" || calls[0]["reason"] != "误触发" {
+		t.Fatalf("累计槽位：%v", calls)
+	}
+}
+
+// 取消挂起的补充：如实确认取消，不派发任何业务动作，会话清空。
+func TestIntentSessionCancelClearsPendingAction(t *testing.T) {
+	srv, st, gate, log := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	gate.script("取消运行", cancelStart(nil, []intentgate.SlotQuestion{
+		{Key: "run_id", Question: "取消哪个运行？"}, {Key: "reason", Question: "取消原因？"}}))
+	code, out := postConversationTurn(t, srv, h, st, convID, "取消运行")
+	if code != 200 {
+		t.Fatalf("第一轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+
+	gate.script("算了不取消了", intentgate.MatchResult{Branch: "matched", ID: "demo.run-cancel",
+		Commands: []intentgate.Command{{Kind: intentgate.CommandCancel, Target: "demo.run-cancel"}}})
+	code, out = postConversationTurn(t, srv, h, st, convID, "算了不取消了")
+	if code != 200 {
+		t.Fatalf("取消轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	if _, executed := out["command"]; executed {
+		t.Fatalf("取消不得派发业务动作：%v", out)
+	}
+	note, ok := out["intent_session"].(map[string]any)
+	if !ok {
+		t.Fatalf("取消应如实回话：%v", out)
+	}
+	if note["kind"] != "cancelled" || note["action"] != "demo.run-cancel" || note["reply"] == "" || note["pending"] != false {
+		t.Fatalf("取消回话：%v", note)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("取消轮派发了动作：%v", log.snapshot())
+	}
+	if pendingIntent(t, st, "", convID) != nil {
+		t.Fatal("取消后仍挂起预期")
+	}
+
+	// 取消之后的回答不得补齐旧动作（这里识别仍不完整 → 只澄清，不派发）。
+	gate.script("编号：R-7", cancelAnswer(map[string]string{"run_id": "R-7"},
+		[]intentgate.SlotQuestion{{Key: "reason", Question: "取消原因？"}}))
+	code, out = postConversationTurn(t, srv, h, st, convID, "编号：R-7")
+	if code != 200 {
+		t.Fatalf("取消后回答轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	if _, executed := out["command"]; executed {
+		t.Fatalf("取消后的回答不得补齐旧动作：%v", out)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("取消后的回答派发了动作：%v", log.snapshot())
+	}
+}
+
+// 过期会话既不补齐旧动作，也不影响新的动作：过期的累计槽位不得被新的一轮
+// 借走，新的任务照常派发。
+func TestIntentSessionExpiryDoesNotCompleteOldAction(t *testing.T) {
+	srv, st, gate, log := cancelServer(t)
+	h := srv.Handler()
+	projectID, convID := setupConversation(t, h)
+	// 第一轮：抽到 run_id，仍缺原因 → 挂起（累计槽位含 run_id）。
+	gate.script("取消运行 编号：R-7", cancelStart(map[string]string{"run_id": "R-7"},
+		[]intentgate.SlotQuestion{{Key: "reason", Question: "取消原因？"}}))
+	code, out := postConversationTurn(t, srv, h, st, convID, "取消运行 编号：R-7")
+	if code != 200 {
+		t.Fatalf("第一轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	pending := pendingIntent(t, st, projectID, convID)
+	if pending == nil || pending.Slots["run_id"] != "R-7" {
+		t.Fatalf("未挂起预期/未累计槽位：%+v", pending)
+	}
+
+	// 把挂起预期推到过去（等价于 30 分钟未续期后仍在库里的行）。
+	expired := &store.IntentExpectation{IntentID: "demo.run-cancel", ActionKind: "command",
+		ActionID: "demo.run-cancel", Missing: []store.IntentSlotQuestion{{Key: "reason", Question: "取消原因？"}}}
+	if _, err := st.PutIntentSession(store.OwnerDefault, projectID, convID, expired,
+		map[string]string{"run_id": "R-7"}, -time.Minute); err != nil {
+		t.Fatal(err)
+	}
+
+	// 第二轮只补了原因：过期的 run_id 不得被借来凑齐动作。
+	answerText := "原因：误触发"
+	gate.script(answerText, cancelStart(map[string]string{"reason": "误触发"}, nil))
+	code, out = postConversationTurn(t, srv, h, st, convID, answerText)
+	if code != 200 {
+		t.Fatalf("过期后的回答轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	if _, executed := out["command"]; executed {
+		t.Fatalf("过期会话不得补齐旧动作：%v", out)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("过期会话派发了动作：%v", log.snapshot())
+	}
+	c := clarifyOf(t, out)
+	if c["command"] != "demo.run-cancel" {
+		t.Fatalf("澄清诉求：%v", c)
+	}
+	missing, _ := c["missing"].([]any)
+	foundRunID := false
+	for _, m := range missing {
+		if m.(map[string]any)["key"] == "run_id" {
+			foundRunID = true
+		}
+	}
+	if !foundRunID {
+		t.Fatalf("过期的累计槽位被借走了：%v", c)
+	}
+	if _, busy := out["intent_session"]; busy {
+		t.Fatalf("过期会话不得产生会话语义字段：%v", out)
+	}
+	if _, err := st.GetIntentSession(store.OwnerDefault, projectID, convID); err != store.ErrNotFound {
+		t.Fatalf("过期行未被惰性删除：%v", err)
+	}
+
+	// 新任务照常派发（过期会话从不干扰新轮次）。
+	if err := srv.Bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "demo.purge", Title: "清理缓存",
+		ParamsSchema: json.RawMessage(`{"type":"object","required":["text"],"properties":{"text":{"type":"string"}}}`)},
+		"", func(_ context.Context, req cmdbus.Request) (any, error) {
+			log.record(req)
+			return map[string]any{"ok": true}, nil
+		}); err != nil {
+		t.Fatal(err)
+	}
+	gate.script("清理缓存", otherIntentStart("demo.purge"))
+	code, out = postConversationTurn(t, srv, h, st, convID, "清理缓存")
+	if code != 200 || out["command"] != "demo.purge" {
+		t.Fatalf("新任务应照常派发：%d %v", code, out)
+	}
+	if calls := log.snapshot(); len(calls) != 1 || calls[0]["text"] != "清理缓存" {
+		t.Fatalf("新任务派发参数：%v", calls)
+	}
+}
+
+// otherIntentStart 是另一个动作的完整识别（换任务）。
+func otherIntentStart(id string) intentgate.MatchResult {
+	return intentgate.MatchResult{Branch: "matched", ID: id,
+		Commands: []intentgate.Command{{Kind: intentgate.CommandStart,
+			Action: intentgate.ActionRef{Kind: intentgate.ActionAuto, ID: id}}}}
+}
+
+// 别的会话/项目的挂起预期绝不互相影响（键含 project + conversation）。
+func TestIntentSessionIsolatesConversations(t *testing.T) {
+	srv, st, gate, log := cancelServer(t)
+	h := srv.Handler()
+	projectA, convA := setupConversation(t, h)
+	projectB, convB := setupConversation(t, h)
+	gate.script("取消运行", cancelStart(nil, []intentgate.SlotQuestion{
+		{Key: "run_id", Question: "取消哪个运行？"}, {Key: "reason", Question: "取消原因？"}}))
+	code, out := postConversationTurn(t, srv, h, st, convA, "取消运行")
+	if code != 200 {
+		t.Fatalf("A 会话第一轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	if pendingIntent(t, st, projectA, convA) == nil {
+		t.Fatal("A 会话未挂起预期")
+	}
+	if pendingIntent(t, st, projectB, convB) != nil {
+		t.Fatal("B 会话看到了 A 的挂起预期")
+	}
+
+	// B 会话收到同样的回答：A 的槽位不得被借走（没有 A 的累计值）。
+	answer := "编号：R-7 原因：误触发"
+	gate.script(answer, cancelAnswer(map[string]string{"run_id": "R-7", "reason": "误触发"}, nil))
+	code, out = postConversationTurn(t, srv, h, st, convB, answer)
+	if code != 200 {
+		t.Fatalf("B 会话回答轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("无挂起预期的会话不得凭别人的槽位派发：%v", log.snapshot())
+	}
+	if pendingIntent(t, st, projectA, convA) == nil {
+		t.Fatal("B 会话的轮次改动了 A 的挂起预期")
+	}
+}
+
+// 高危动作仍走 cmdbus 确认：会话补齐不绕过确认卡（处理器不执行）。
+func TestIntentSessionStillRequiresHighRiskConfirmation(t *testing.T) {
+	risky := cancelSpec
+	risky.Danger = agentcommand.DangerHigh
+	srv, st, gate, log := cancelServerWith(t, risky)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	gate.script("取消运行", cancelStart(nil, []intentgate.SlotQuestion{
+		{Key: "run_id", Question: "取消哪个运行？"}, {Key: "reason", Question: "取消原因？"}}))
+	code, out := postConversationTurn(t, srv, h, st, convID, "取消运行")
+	if code != 200 {
+		t.Fatalf("第一轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	answer := "编号：R-7 原因：误触发"
+	gate.script(answer, cancelAnswer(map[string]string{"run_id": "R-7", "reason": "误触发"}, nil))
+	code, out = postConversationTurn(t, srv, h, st, convID, answer)
+	if code != 200 || out["command"] != "demo.run-cancel" {
+		t.Fatalf("补齐后应派发到总线：%d %v", code, out)
+	}
+	if out["card"] == nil {
+		t.Fatalf("高危动作必须仍要确认卡：%v", out)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("确认前不得执行处理器：%v", log.snapshot())
+	}
+}
+
+// 非法槽位的补充照旧按非法追问：值不采纳、动作不派发。
+func TestIntentSessionInvalidAnswerKeepsClarifying(t *testing.T) {
+	srv, st, gate, log := cancelServer(t)
+	h := srv.Handler()
+	_, convID := setupConversation(t, h)
+	gate.script("取消运行", cancelStart(nil, []intentgate.SlotQuestion{
+		{Key: "run_id", Question: "取消哪个运行？"}}))
+	code, out := postConversationTurn(t, srv, h, st, convID, "取消运行")
+	if code != 200 {
+		t.Fatalf("第一轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+
+	gate.script("编号：R-9", intentgate.MatchResult{Branch: "expectation_hit", ID: "demo.run-cancel",
+		Slots:   map[string]string{"run_id": "R-9"},
+		Invalid: []intentgate.SlotDefect{{Key: "run_id", Reason: "unknown run", Question: "取消哪个运行？", Invalid: true}}})
+	code, out = postConversationTurn(t, srv, h, st, convID, "编号：R-9")
+	if code != 200 {
+		t.Fatalf("非法补充轮：%d %v", code, out)
+	}
+	settle(t, h, out)
+	if _, executed := out["command"]; executed {
+		t.Fatalf("非法补充不得派发：%v", out)
+	}
+	c := clarifyOf(t, out)
+	invalid, _ := c["invalid"].([]any)
+	if len(invalid) != 1 || invalid[0].(map[string]any)["reason"] != "unknown run" {
+		t.Fatalf("非法原因未透传：%v", c)
+	}
+	if len(log.snapshot()) != 0 {
+		t.Fatalf("非法补充派发了动作：%v", log.snapshot())
+	}
+	pending := pendingIntent(t, st, "", convID)
+	if pending == nil || pending.Slots["run_id"] != "" {
+		t.Fatalf("非法值不得进入会话槽位表：%+v", pending)
+	}
+}
+
+// 无会话时行为逐字节不变：与「会话关闭」的服务器跑同一脚本，响应（去掉
+// run/message 这类每次都不同的回执）逐字节一致，且不得出现会话语义字段。
+func TestIntentSessionLegacyResponsesUnchanged(t *testing.T) {
+	script := func(gate *scriptedGate) {
+		// 槽位齐全：照常派发（会话层不得介入）。
+		gate.script("取消运行 编号：R-3 原因：误触发", cancelStart(
+			map[string]string{"run_id": "R-3", "reason": "误触发"}, nil))
+		gate.script("今天天气如何", intentgate.MatchResult{Branch: "fallback"})
+		gate.script("算了", intentgate.MatchResult{Branch: "matched", ID: "demo.purge",
+			Commands: []intentgate.Command{{Kind: intentgate.CommandCancel, Target: "demo.purge"}}})
+		gate.script("取消运行", cancelStart(nil, []intentgate.SlotQuestion{
+			{Key: "run_id", Question: "取消哪个运行？"}, {Key: "reason", Question: "取消原因？"}}))
+	}
+	// summarize 把响应投影成与运行无关的稳定形态：顶层键、命令、澄清诉求。
+	summarize := func(out map[string]any) string {
+		keys := make([]string, 0, len(out))
+		for k := range out {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		var b strings.Builder
+		b.WriteString(strings.Join(keys, ","))
+		if cmd, ok := out["command"]; ok {
+			raw, _ := json.Marshal(cmd)
+			b.WriteString("|command=" + string(raw))
+		}
+		if c, ok := out["clarify"]; ok {
+			raw, _ := json.Marshal(c)
+			b.WriteString("|clarify=" + string(raw))
+		}
+		if n, ok := out["intent_session"]; ok {
+			raw, _ := json.Marshal(n)
+			b.WriteString("|session=" + string(raw))
+		}
+		return b.String()
+	}
+	run := func(t *testing.T, sessions IntentSessions) []string {
+		t.Helper()
+		srv, st, gate, log := cancelServer(t)
+		if sessions != nil {
+			srv.SetIntentSessionService(sessions)
+		}
+		script(gate)
+		h := srv.Handler()
+		_, convID := setupConversation(t, h)
+		var summaries []string
+		for _, text := range []string{"取消运行 编号：R-3 原因：误触发", "今天天气如何", "算了", "取消运行"} {
+			code, out := postConversationTurn(t, srv, h, st, convID, text)
+			if code != 200 {
+				t.Fatalf("%s：%d %v", text, code, out)
+			}
+			settle(t, h, out)
+			summaries = append(summaries, text+" -> "+summarize(out))
+		}
+		if len(log.snapshot()) != 1 {
+			t.Fatalf("脚本只应派发一次完整动作：%v", log.snapshot())
+		}
+		return summaries
+	}
+
+	withSessions := run(t, nil)
+	// 关闭会话语义（替身永不挂起/折叠）后同一脚本的响应必须逐字节一致。
+	without := run(t, inertSessions{})
+	if len(withSessions) != len(without) {
+		t.Fatalf("轮次数不一致：%v vs %v", withSessions, without)
+	}
+	for i := range withSessions {
+		if withSessions[i] != without[i] {
+			t.Fatalf("无会话时行为发生变化：\n 有：%s\n 无：%s", withSessions[i], without[i])
+		}
+		if strings.Contains(withSessions[i], "session=") {
+			t.Fatalf("无会话语义的轮次带上了会话语义字段：%s", withSessions[i])
+		}
+	}
+	if !strings.Contains(strings.Join(withSessions, "\n"), "|clarify=") {
+		t.Fatalf("脚本未触发澄清，测试失去意义：%v", withSessions)
+	}
+}
+
+// inertSessions 是「关闭会话语义」的替身：任何调用都如实报告没有会话。
+type inertSessions struct{}
+
+func (inertSessions) Pending(intentsession.Key) (*intentsession.Session, error) { return nil, nil }
+func (inertSessions) Suspend(intentsession.Key, intentsession.Expectation, map[string]string) (*intentsession.Session, error) {
+	return nil, nil
+}
+func (inertSessions) ApplyAnswer(intentsession.Key, int, intentsession.Answer) (*intentsession.Outcome, error) {
+	return nil, nil
+}
+func (inertSessions) ApplyCommand(intentsession.Key, int, string, string, string) (*intentsession.Outcome, error) {
+	return nil, nil
+}
+func (inertSessions) Drop(intentsession.Key) error { return nil }
+func (inertSessions) Binding(intentsession.Key) (*intentsession.Binding, error) {
+	return nil, nil
+}
+func (inertSessions) RecordCancel(intentsession.Key, intentsession.Binding) (*intentsession.Session, error) {
+	return nil, nil
+}
+
+// pendingIntent 读当前会话的挂起预期（测试只读断言面；过期即视为没有）。
+func pendingIntent(t *testing.T, st *store.Store, projectID, convID string) *intentsession.Session {
+	t.Helper()
+	conv, err := st.GetConversation(store.OwnerDefault, convID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if projectID == "" {
+		projectID = string(conv.ProjectID)
+	}
+	sess, err := intentsession.New(st).Pending(intentsession.Key{
+		Owner: store.OwnerDefault, Project: projectID, Conversation: convID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return sess
+}

internal/server/operation_query.go

@@ -0,0 +1,87 @@
+package server
+
+import (
+	"errors"
+	"net/http"
+
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+)
+
+// commandOperationQuery 把"已记录 operation 的状态查询"落在既有的 owner+project
+// 作用域审计查询上（store.ListProjectCommandAudits），不新建通用幂等平台：不加表、
+// 不加索引、不引入新的重试语义。命令回执（审计信封）本就是宿主侧的操作记录，
+// handler 自己事务/发件箱里的领域操作表（如文档投递 document_render_deliveries）
+// 仍由各自领域查询负责。
+//
+// 诚实边界：
+//   - 只有成功落下审计信封的 operation 查得到。审计不可用时总线回 unknown +
+//     operationID，但那一行没有落库：这里返回"无记录"，绝不推断"未执行"。
+//   - 扫描有界（最近若干页）：超出窗口的旧操作返回无记录，而不是全表扫描。
+//   - project_id 是追加时按可信会话快照下来的归属；改绑/删除会话不改写历史归属，
+//     与既有项目审计查询同一口径。
+type commandOperationQuery struct{ st *store.Store }
+
+const (
+	operationLookupPageSize = 100
+	operationLookupMaxPages = 20 // 有界扫描：最近 2000 行，超窗即"无记录"
+)
+
+func (q commandOperationQuery) LookupOperation(owner, projectID, operationID string) (cmdbus.OperationRecord, bool, error) {
+	if q.st == nil || owner == "" || projectID == "" || operationID == "" {
+		return cmdbus.OperationRecord{}, false, nil
+	}
+	var before, cutoff int64
+	for page := 0; page < operationLookupMaxPages; page++ {
+		rows, resolvedCutoff, next, err := q.st.ListProjectCommandAudits(owner, projectID, before, cutoff, operationLookupPageSize)
+		if err != nil {
+			return cmdbus.OperationRecord{}, false, err
+		}
+		cutoff = resolvedCutoff // 首帧固定游标，后续页在同一提交前缀内翻页
+		for _, row := range rows {
+			if row.Envelope.OperationID != operationID {
+				continue
+			}
+			return cmdbus.OperationRecord{
+				OperationID: row.Envelope.OperationID,
+				CommandID:   row.Envelope.CommandID,
+				State:       row.Envelope.State,
+				Time:        row.Envelope.Time,
+			}, true, nil
+		}
+		if next == 0 {
+			return cmdbus.OperationRecord{}, false, nil
+		}
+		before = next
+	}
+	return cmdbus.OperationRecord{}, false, nil
+}
+
+// getCommandOperation 是 unknown 回执的对账入口（R7/KTD6）：
+// GET /api/commands/operations/{operationId}?projectId=…
+//
+// 授权复用既有口径：owner 只取自认证上下文（不读请求参数），projectId 仅用于
+// 收窄到该 owner 名下的项目——与 /api/commands/audit 同源，跨租户天然不可见。
+// 查不到一律 404：HTTP 层的"没有记录"同样不得被读成"未执行"。
+func (s *Server) getCommandOperation(w http.ResponseWriter, r *http.Request) {
+	if s.Bus == nil {
+		http.Error(w, "commands disabled", http.StatusServiceUnavailable)
+		return
+	}
+	record, err := s.Bus.LookupOperation(s.owner(r), r.URL.Query().Get("projectId"), r.PathValue("operationId"))
+	switch {
+	case errors.Is(err, cmdbus.ErrOperationScope):
+		http.Error(w, "projectId and operationId are required", http.StatusBadRequest)
+		return
+	case errors.Is(err, cmdbus.ErrOperationQueryUnavailable):
+		http.Error(w, "operation query unavailable", http.StatusServiceUnavailable)
+		return
+	case errors.Is(err, cmdbus.ErrOperationNotRecorded):
+		http.Error(w, "no operation record in this scope", http.StatusNotFound)
+		return
+	case err != nil:
+		writeStoreErr(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"operation": record})
+}

internal/server/operation_query_test.go

@@ -0,0 +1,96 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+)
+
+// TestCommandOperationLookupIsOwnerProjectScoped 覆盖 U7b/R7 的对账查询：
+// unknown 回执给出的 operationID 能按认证 owner + project 查到落库记录；
+// 跨 owner、错 project、缺 projectId 一律查不到或拒（fail-closed），任何
+// "查不到"都不得被读成"未执行"。
+func TestCommandOperationLookupIsOwnerProjectScoped(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	srv.Bus = cmdbus.New(st, nil, time.Now)
+	srv.WireBuiltinCommands() // 生产装配点：总线拿到宿主侧对账查询端口
+	h := srv.Handler()
+
+	aliceKey, err := createLegacyAPIKeyFixture(t, st, "alice", "e2e")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bobKey, err := createLegacyAPIKeyFixture(t, st, "bob", "e2e")
+	if err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "对账项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conversation, err := st.CreateConversation("alice", project.ID, "对账会话", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// 写库之后才失败的命令：unknown + operationID（审计信封按会话快照落项目）。
+	if err := srv.Bus.RegisterPluginCommand(agentcommand.CommandSpec{ID: "demo.write", Title: "写入"},
+		func(context.Context, cmdbus.Request) (any, error) { return nil, errors.New("ack lost") }); err != nil {
+		t.Fatal(err)
+	}
+	resp := srv.Bus.Dispatch(context.Background(), cmdbus.Request{
+		ID: "demo.write", Owner: "alice", Actor: "alice", ConversationID: conversation.ID,
+	})
+	if resp.Receipt.State != agentcommand.StateUnknown || resp.Receipt.OperationID == "" {
+		t.Fatalf("post-execution failure must be unknown with an operation ID: %+v", resp.Receipt)
+	}
+	operationID := resp.Receipt.OperationID
+
+	get := func(key, url string) *httptest.ResponseRecorder {
+		t.Helper()
+		req := httptest.NewRequest(http.MethodGet, url, nil)
+		req.Header.Set("Authorization", "Bearer "+key)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec
+	}
+
+	rec := get(aliceKey, "/api/commands/operations/"+operationID+"?projectId="+project.ID)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("owner lookup: %d %s", rec.Code, rec.Body.String())
+	}
+	var out struct {
+		Operation struct {
+			OperationID string `json:"OperationID"`
+			CommandID   string `json:"CommandID"`
+			State       string `json:"State"`
+		} `json:"operation"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if out.Operation.OperationID != operationID || out.Operation.CommandID != "demo.write" || out.Operation.State != string(agentcommand.StateUnknown) {
+		t.Fatalf("lookup projection wrong: %+v", out.Operation)
+	}
+
+	for _, tc := range []struct {
+		name, key, url string
+		want           int
+	}{
+		{"cross owner", bobKey, "/api/commands/operations/" + operationID + "?projectId=" + project.ID, http.StatusNotFound},
+		{"wrong project", aliceKey, "/api/commands/operations/" + operationID + "?projectId=prj_other", http.StatusNotFound},
+		{"missing project", aliceKey, "/api/commands/operations/" + operationID, http.StatusBadRequest},
+		{"missing operation", aliceKey, "/api/commands/operations/op_absent?projectId=" + project.ID, http.StatusNotFound},
+	} {
+		if rec := get(tc.key, tc.url); rec.Code != tc.want {
+			t.Fatalf("%s: %d %s (want %d)", tc.name, rec.Code, rec.Body.String(), tc.want)
+		}
+	}
+}

internal/server/project_iam_integration_test.go

@@ -266,10 +266,13 @@ func newIAMFixture(t *testing.T) *iamFixture {
 		member, _ := req.Params["member"].(string)
 		err := f.provider.addMember(ctx, srv.lifecycleHost(req.Owner), projectID, member)
 		if failure, ok := categorizeWorkFailure(extension.WorkOperationMemberAdd, err); ok {
-			return nil, failure
+			// 假 provider 的每条失败路径都发生在改成员之前（唯一写点在最后一行
+			// 且随后返回 nil），因此显式声明 not-executed：拒绝语义与 4xx 映射
+			// 由此成立，而不是靠“报了错就算没执行”（F10）。
+			return nil, cmdbus.NotExecuted(failure)
 		}
 		if err != nil {
-			return nil, err
+			return nil, cmdbus.NotExecuted(err)
 		}
 		return map[string]any{"ok": true}, nil
 	}); err != nil {

internal/server/project_lifecycle.go

@@ -21,7 +21,24 @@ func (s *Server) lifecycleHost(owner string) extension.Host {
 	}
 	return s.projectHost(owner)
 }
+
+// scratchProjectWork 让临时会话的属主在没有 RDM provider 时也能工作。scratch 项目
+// 从不进入 RDM：provider 只会报 Work=false，属主会被自己的临时会话挡住（U2 核心）。
+// 所以门禁先走存储侧归属：属主放行且不再问 provider，非属主一律 NotFound（与
+// 项目工作同一错误面）。handled=false 表示这不是临时会话，调用点照旧。
+func (s *Server) scratchProjectWork(owner, projectID string) (handled bool, err error) {
+	if s.st == nil {
+		return false, nil
+	}
+	return s.st.ScratchProjectDecision(projectID, owner)
+}
+
 func (s *Server) projectWork(ctx context.Context, owner, projectID string) error {
+	if handled, err := s.scratchProjectWork(owner, projectID); err != nil {
+		return err
+	} else if handled {
+		return nil
+	}
 	if s.projectLifecycle == nil {
 		return nil
 	}
@@ -48,6 +65,12 @@ func (s *Server) projectWork(ctx context.Context, owner, projectID string) error
 // With no resource authorizer registered (EXT-8b V2 absent) this is exactly
 // projectWork, so un-extended hosts keep their current denial unchanged.
 func (s *Server) projectRead(ctx context.Context, owner, projectID string) error {
+	if handled, err := s.scratchProjectWork(owner, projectID); err != nil {
+		return err
+	} else if handled {
+		// 临时会话只对属主可读：共享域回落永远不参与（它不是共享资源）。
+		return nil
+	}
 	if s.projectLifecycle == nil {
 		return nil
 	}
@@ -70,7 +93,12 @@ func (s *Server) projectRead(ctx context.Context, owner, projectID string) error
 
 // createPrivateConversation is shared by the API and /new. Only live work
 // authorization grants member creation; the resulting conversation stays owned.
+// A scratch project already holds its one private conversation, so this shared
+// path refuses a second one instead of handing out a normal session under it.
 func (s *Server) createPrivateConversation(ctx context.Context, owner, projectID, title, profile string) (core.Conversation, error) {
+	if err := s.rejectScratchProjectConversation(projectID, owner); err != nil {
+		return core.Conversation{}, err
+	}
 	if s.projectLifecycle != nil {
 		if err := s.projectWork(ctx, owner, projectID); err != nil {
 			return core.Conversation{}, err
@@ -83,6 +111,24 @@ func (s *Server) createPrivateConversation(ctx context.Context, owner, projectID
 	}
 	return c, err
 }
+
+// rejectScratchProjectConversation keeps the scratch 1:1 rule on the shared
+// conversation-create path (POST /api/projects/{id}/conversations and /new).
+// The lookup is the internal trusted one, and it is ownership-aware: a non-owner
+// is not told anything about the session (projectWork answers NotFound), while
+// the owner still gets the 1:1 refusal. Nothing here is returned to the caller
+// for an unreadable project, which the store path decides as before.
+func (s *Server) rejectScratchProjectConversation(projectID, owner string) error {
+	if s.st == nil {
+		return nil
+	}
+	handled, err := s.st.ScratchProjectDecision(projectID, owner)
+	if !handled || err != nil {
+		return nil
+	}
+	return store.ErrScratchSessionSingle
+}
+
 func writeProjectErr(w http.ResponseWriter, err error) {
 	var coded interface{ StatusCode() int }
 	if errors.As(err, &coded) {

internal/server/run_diagnostics.go

@@ -0,0 +1,32 @@
+package server
+
+import (
+	"net/http"
+	"time"
+
+	"agent-system-backend/internal/rundiag"
+)
+
+// getRunDiagnostics 是单次 run 的只读诊断入口（feature unit A2）：
+//
+//	GET /api/runs/{id}/diagnostics
+//
+// 它回答值班/排障最常问的六个问题：这个 run 卡在哪（responsibility.state）、
+// 谁该动（responsibility.role）、为什么在等（responsibility.wait_reason）、最后一个
+// 稳定落盘点（last_checkpoint）、已知的外部副作用（side_effects）、下一步动作
+// （next_step）。
+//
+// 授权口径与既有 run 读入口逐字同款：owner 只取自认证上下文，绝不接受请求参数；
+// run 由 store.GetRun(owner, id) 做租户过滤，跨租户与不存在同为 404（不泄露存在性）。
+// handler 路径上只有 SELECT——不给写操作、不改状态、不触发任何副作用；聚合逻辑在
+// internal/rundiag，证据缺失一律降级为 unknown + notes，不编造检查点，也不把"没有
+// 记录"读成"没有发生"。
+func (s *Server) getRunDiagnostics(w http.ResponseWriter, r *http.Request) {
+	run, err := s.st.GetRun(s.owner(r), r.PathValue("id"))
+	if err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	evidence := rundiag.Gather(s.st, run, time.Now().UTC())
+	writeJSON(w, http.StatusOK, rundiag.Build(evidence))
+}

internal/server/run_diagnostics_test.go

@@ -0,0 +1,226 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+// diagnosticsFixture 建一个 owner 名下的项目/会话/run（合成数据，无执行器）。
+func diagnosticsFixture(t *testing.T, st *store.Store, owner string, status core.RunStatus) (core.Run, core.Conversation) {
+	t.Helper()
+	project, err := st.CreateProject(owner, "诊断项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conversation, err := st.CreateConversation(owner, project.ID, "诊断会话", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run := core.Run{
+		ConversationID: conversation.ID, ProjectID: project.ID, Owner: owner,
+		Kind: core.RunConversation, Status: status, Phase: core.PhaseActing, CreatedAt: time.Now().UTC(),
+	}
+	if err := st.CreateRun(&run); err != nil {
+		t.Fatal(err)
+	}
+	return run, conversation
+}
+
+func getDiagnostics(t *testing.T, h http.Handler, key, path string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	if key != "" {
+		req.Header.Set("Authorization", "Bearer "+key)
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+func decodeReport(t *testing.T, rec *httptest.ResponseRecorder) map[string]any {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("diagnostics: %d %s", rec.Code, rec.Body.String())
+	}
+	var out map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatalf("decode diagnostics: %v (%s)", err, rec.Body.String())
+	}
+	return out
+}
+
+// 授权口径与既有 run 读入口同款：未认证 401、跨 owner 404（不泄露存在性）、
+// 不存在的 run 同样 404。
+func TestRunDiagnosticsOwnerScopingMatchesRunReads(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	aliceKey, err := createLegacyAPIKeyFixture(t, st, "alice", "e2e")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bobKey, err := createLegacyAPIKeyFixture(t, st, "bob", "e2e")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run, _ := diagnosticsFixture(t, st, "alice", core.RunRunning)
+	path := "/api/runs/" + string(run.ID) + "/diagnostics"
+
+	if rec := getDiagnostics(t, h, "", path); rec.Code != http.StatusUnauthorized {
+		t.Fatalf("unauthenticated diagnostics must be rejected: %d", rec.Code)
+	}
+	if rec := getDiagnostics(t, h, bobKey, path); rec.Code != http.StatusNotFound {
+		t.Fatalf("cross-owner diagnostics must not leak the payload: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := getDiagnostics(t, h, aliceKey, "/api/runs/run_missing/diagnostics"); rec.Code != http.StatusNotFound {
+		t.Fatalf("missing run must be 404: %d", rec.Code)
+	}
+	rec := getDiagnostics(t, h, aliceKey, path)
+	report := decodeReport(t, rec)
+	runSection, _ := report["run"].(map[string]any)
+	if runSection["id"] != string(run.ID) || runSection["owner"] != "alice" || runSection["project"] != string(run.ProjectID) {
+		t.Fatalf("run identity wrong: %v", runSection)
+	}
+	responsibility, _ := report["responsibility"].(map[string]any)
+	if responsibility["state"] != "running" {
+		t.Fatalf("a running run with no blockers reads as running: %v", responsibility)
+	}
+}
+
+// 隔离中的 run：责任在副作用责任人，下一步是解除隔离；检查点与已记录的命令
+// 回执一并给出。
+func TestRunDiagnosticsReportsHoldCheckpointAndSideEffects(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, err := createLegacyAPIKeyFixture(t, st, "alice", "e2e")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run, conversation := diagnosticsFixture(t, st, "alice", core.RunRunning)
+	if _, err := st.AppendEvents(string(conversation.ID), []core.StreamEvent{
+		{RunID: run.ID, Type: core.EvThinkingDelta, Payload: json.RawMessage(`{"index":0,"text":"核对差异"}`)},
+		{RunID: run.ID, Type: core.EvAgentProgress, Payload: json.RawMessage(`{"note":"核对中"}`)},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.AppendAudit("alice", agentcommand.AuditEnvelope{
+		Time: time.Now().UTC(), Actor: "alice", CommandID: "rdm.docs.instantiate",
+		OperationID: "op_diag_1", ConversationID: string(conversation.ID), State: agentcommand.StateUnknown,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.SetRecoveryHold(string(run.ID), "alice", string(conversation.ID), "外部副作用结果未知"); err != nil {
+		t.Fatal(err)
+	}
+
+	report := decodeReport(t, getDiagnostics(t, h, key, "/api/runs/"+string(run.ID)+"/diagnostics"))
+	responsibility, _ := report["responsibility"].(map[string]any)
+	if responsibility["state"] != "recovery_hold" || responsibility["role"] != "operation-owner" {
+		t.Fatalf("held run responsibility: %v", responsibility)
+	}
+	nextStep, _ := report["next_step"].(map[string]any)
+	if nextStep["action"] != "release_recovery_hold" {
+		t.Fatalf("held run next step: %v", nextStep)
+	}
+	checkpoint, _ := report["last_checkpoint"].(map[string]any)
+	if checkpoint == nil || checkpoint["type"] != string(core.EvAgentProgress) {
+		t.Fatalf("last persisted checkpoint must be surfaced: %v", report["last_checkpoint"])
+	}
+	effects, _ := report["side_effects"].([]any)
+	var foundOperation bool
+	for _, raw := range effects {
+		effect, _ := raw.(map[string]any)
+		if effect["kind"] == "operation" && effect["operation_id"] == "op_diag_1" {
+			foundOperation = true
+			if effect["command_id"] != "rdm.docs.instantiate" || effect["state"] != string(agentcommand.StateUnknown) {
+				t.Fatalf("operation projection: %v", effect)
+			}
+		}
+	}
+	if !foundOperation {
+		t.Fatalf("recorded operation missing from side effects: %v", effects)
+	}
+}
+
+// 只读契约：GET 不改任何状态，写方法不注册。
+func TestRunDiagnosticsIsReadOnly(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, err := createLegacyAPIKeyFixture(t, st, "alice", "e2e")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run, conversation := diagnosticsFixture(t, st, "alice", core.RunRunning)
+	if err := st.SetRecoveryHold(string(run.ID), "alice", string(conversation.ID), "unknown"); err != nil {
+		t.Fatal(err)
+	}
+	before, err := st.GetRun("alice", string(run.ID))
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := "/api/runs/" + string(run.ID) + "/diagnostics"
+	if rec := getDiagnostics(t, h, key, path); rec.Code != http.StatusOK {
+		t.Fatalf("diagnostics: %d %s", rec.Code, rec.Body.String())
+	}
+	after, err := st.GetRun("alice", string(run.ID))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if before.Status != after.Status || before.Phase != after.Phase || !before.CreatedAt.Equal(after.CreatedAt) {
+		t.Fatalf("read-only endpoint mutated the run: %+v -> %+v", before, after)
+	}
+	hold, err := st.GetRecoveryHold(string(run.ID))
+	if err != nil || hold.ReleasedAt != "" {
+		t.Fatalf("read-only endpoint changed the recovery hold: %+v err=%v", hold, err)
+	}
+	for _, method := range []string{http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch} {
+		req := httptest.NewRequest(method, path, nil)
+		req.Header.Set("Authorization", "Bearer "+key)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code == http.StatusOK || rec.Code == http.StatusAccepted {
+			t.Fatalf("%s must not be served on a read-only diagnostics path: %d", method, rec.Code)
+		}
+	}
+}
+
+// 读不到的证据降级为 unknown + note，不让整个诊断失败，也不给出安全重试。
+func TestRunDiagnosticsUnknownStateDegradesWithNote(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, err := createLegacyAPIKeyFixture(t, st, "alice", "e2e")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run, _ := diagnosticsFixture(t, st, "alice", core.RunCancelled)
+
+	report := decodeReport(t, getDiagnostics(t, h, key, "/api/runs/"+string(run.ID)+"/diagnostics"))
+	responsibility, _ := report["responsibility"].(map[string]any)
+	if responsibility["state"] != "unknown" {
+		t.Fatalf("unmapped status must degrade to unknown: %v", responsibility)
+	}
+	if report["last_checkpoint"] != nil {
+		t.Fatalf("no persisted event means no checkpoint reference: %v", report["last_checkpoint"])
+	}
+	notes, _ := report["notes"].([]any)
+	var sawStatusNote, sawEffectNote bool
+	for _, raw := range notes {
+		note, _ := raw.(string)
+		if strings.Contains(note, "no diagnostic mapping") {
+			sawStatusNote = true
+		}
+		if strings.Contains(note, "absence of records is not proof") {
+			sawEffectNote = true
+		}
+	}
+	if !sawStatusNote || !sawEffectNote {
+		t.Fatalf("missing degradation notes: %v", notes)
+	}
+}

internal/server/scratch_flag_test.go

@@ -0,0 +1,150 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"agent-system-backend/internal/store"
+)
+
+// 会话响应上的 scratch 标记（U2B）：临时会话在任务列表、项目会话列表与详情里都
+// 带 scratch=true，普通项目的会话没有这个键——前端据此把临时会话归到“无项目对话”，
+// 不必再从项目列表反推。
+
+// conversationRow 保留原始 JSON 对象：标记在不在键里都能看见。
+type conversationRow map[string]any
+
+func decodeConversationRows(t *testing.T, rec *httptest.ResponseRecorder) map[string]conversationRow {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("list conversations: %d %s", rec.Code, rec.Body.String())
+	}
+	var rows []conversationRow
+	if err := json.Unmarshal(rec.Body.Bytes(), &rows); err != nil {
+		t.Fatalf("decode conversations: %v body=%s", err, rec.Body.String())
+	}
+	byID := map[string]conversationRow{}
+	for _, row := range rows {
+		id, _ := row["id"].(string)
+		if id == "" {
+			t.Fatalf("conversation without id: %s", rec.Body.String())
+		}
+		byID[id] = row
+	}
+	return byID
+}
+
+// assertScratchFlag 校验一条会话：want=true 必须带 scratch=true；want=false 时
+// 必须完全没有 scratch 键（普通项目的会话 JSON 与加标记之前同形）。
+func assertScratchFlag(t *testing.T, where string, row conversationRow, want bool) {
+	t.Helper()
+	if row == nil {
+		t.Fatalf("%s: conversation missing from the response", where)
+	}
+	raw, ok := row["scratch"]
+	if !want {
+		if ok {
+			t.Fatalf("%s: non-scratch conversation carries scratch: %v", where, raw)
+		}
+		return
+	}
+	if flag, _ := raw.(bool); !ok || !flag {
+		t.Fatalf("%s: scratch conversation is not marked: %v", where, raw)
+	}
+}
+
+func createdConversationObject(t *testing.T, rec *httptest.ResponseRecorder) conversationRow {
+	t.Helper()
+	var body struct {
+		Conversation conversationRow `json:"conversation"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode scratch session: %v body=%s", err, rec.Body.String())
+	}
+	return body.Conversation
+}
+
+// scratchFlagIDs 是 fixture 造出来的两条会话（普通 + 临时）的 id 与项目 id。
+type scratchFlagIDs struct {
+	normalID, normalProjectID   string
+	scratchID, scratchProjectID string
+}
+
+// scratchFlagFixture 造一个普通项目的会话和一个临时会话。临时会话走 HTTP 创建，
+// 因此创建响应上的标记也一并断言。
+func scratchFlagFixture(t *testing.T, h http.Handler, st *store.Store, key string) scratchFlagIDs {
+	t.Helper()
+	project, err := st.CreateProjectAccountChecked("engineer", "普通项目", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	normal, err := st.CreateConversation("engineer", string(project.ID), "普通会话", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created := bearerRequest(h, "POST", "/api/scratch-sessions", `{}`, key)
+	if created.Code != http.StatusOK {
+		t.Fatalf("create scratch session: %d %s", created.Code, created.Body.String())
+	}
+	view := decodeScratchSessionHTTP(t, created)
+	if view.Project.ID == "" || view.Conversation.ID == "" {
+		t.Fatalf("incomplete scratch session: %s", created.Body.String())
+	}
+	assertScratchFlag(t, "POST /api/scratch-sessions", createdConversationObject(t, created), true)
+	return scratchFlagIDs{
+		normalID: string(normal.ID), normalProjectID: string(project.ID),
+		scratchID: view.Conversation.ID, scratchProjectID: view.Project.ID,
+	}
+}
+
+// TestScratchFlagOnConversationResponses 同一份 fixture 上验证三条读取路径：
+// 任务列表、项目会话列表、会话详情——临时会话带 scratch=true，普通项目的会话
+// 不带这个键。
+func TestScratchFlagOnConversationResponses(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key := scratchAccountKey(t, st, "engineer")
+	ids := scratchFlagFixture(t, h, st, key)
+
+	tasks := decodeConversationRows(t, bearerRequest(h, "GET", "/api/conversations", "", key))
+	if len(tasks) != 2 {
+		t.Fatalf("task list must hold both conversations: %d %+v", len(tasks), tasks)
+	}
+	if tasks[ids.scratchID] == nil || tasks[ids.normalID] == nil {
+		t.Fatalf("task list does not cover both conversations: %+v", tasks)
+	}
+	assertScratchFlag(t, "GET /api/conversations (scratch)", tasks[ids.scratchID], true)
+	assertScratchFlag(t, "GET /api/conversations (normal)", tasks[ids.normalID], false)
+
+	scratchUnder := decodeConversationRows(t, bearerRequest(h, "GET", "/api/projects/"+ids.scratchProjectID+"/conversations", "", key))
+	normalUnder := decodeConversationRows(t, bearerRequest(h, "GET", "/api/projects/"+ids.normalProjectID+"/conversations", "", key))
+	assertScratchFlag(t, "GET /api/projects/{scratch}/conversations", scratchUnder[ids.scratchID], true)
+	assertScratchFlag(t, "GET /api/projects/{normal}/conversations", normalUnder[ids.normalID], false)
+
+	for _, tc := range []struct {
+		name    string
+		id      string
+		scratch bool
+	}{
+		{"scratch", ids.scratchID, true},
+		{"normal", ids.normalID, false},
+	} {
+		rec := bearerRequest(h, "GET", "/api/conversations/"+tc.id, "", key)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("detail %s: %d %s", tc.name, rec.Code, rec.Body.String())
+		}
+		var body struct {
+			Conversation conversationRow `json:"conversation"`
+		}
+		if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+			t.Fatalf("decode detail %s: %v body=%s", tc.name, err, rec.Body.String())
+		}
+		if body.Conversation["id"] != tc.id {
+			t.Fatalf("detail %s returned %v", tc.name, body.Conversation["id"])
+		}
+		assertScratchFlag(t, "GET /api/conversations/{id} ("+tc.name+")", body.Conversation, tc.scratch)
+	}
+}

internal/server/scratch_gates_test.go

@@ -0,0 +1,311 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	agentcommand "agent-command"
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	"agent-system-backend/pkg/extension"
+	core "agent-system-core"
+)
+
+// 临时会话隔离门禁（U2）。产品规则：scratch 会话是“只属于自己的通用代理会话”——
+// 属主能像普通聊天一样用它，但它不共享任何文档/上下文，也不触达项目域能力。
+// 每个门禁都成对验证：owner 放行、其他人/其它项目照旧。
+
+// scratchGateFixture 建一个已登录的属主账号并落下一个临时会话。
+func scratchGateFixture(t *testing.T, srv *Server, st *store.Store, owner string) (key, projectID, conversationID string) {
+	t.Helper()
+	key = scratchAccountKey(t, st, owner)
+	rec := bearerRequest(srv.Handler(), "POST", "/api/scratch-sessions", `{}`, key)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("create scratch session: %d %s", rec.Code, rec.Body.String())
+	}
+	view := decodeScratchSessionHTTP(t, rec)
+	return key, view.Project.ID, view.Conversation.ID
+}
+
+// TestScratchOwnerWorksWithoutRDMProvider 是 U2 的核心：注册一个 Work 恒为 false
+// 的 projectLifecycle（RDM 从未听说过 scratch 项目）后，属主仍能在自己的临时
+// 会话里发消息，而别的账号读不到这个临时会话——即使共享授权适配器对所有人放行。
+func TestScratchOwnerWorksWithoutRDMProvider(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	aliceKey, projectID, conversationID := scratchGateFixture(t, srv, st, "alice")
+	bobKey := scratchAccountKey(t, st, "bob")
+
+	providerCalls := 0
+	srv.SetProjectLifecycle(extension.ProjectLifecycle{
+		Work: func(context.Context, string, core.ID) (bool, error) {
+			providerCalls++
+			return false, nil // RDM 视角：没有这个项目
+		},
+	}, nil)
+	// 共享域适配器对任何人都放行（最宽松的现网配置），临时会话仍不可共享。
+	srv.SetProjectAuthorizer(func(string, core.ID) (bool, error) { return true, nil })
+	srv.SetResourceAuthorizerV2(func(extension.ResourceAuthzQuery) (bool, error) { return true, nil })
+
+	rec := bearerRequest(h, "POST", "/api/conversations/"+conversationID+"/messages", `{"text":"帮我总结这段话"}`, aliceKey)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("scratch owner could not chat without the provider: %d %s", rec.Code, rec.Body.String())
+	}
+	msgs, err := st.ListMessages(conversationID)
+	if err != nil || len(msgs) == 0 {
+		t.Fatalf("owner message not persisted: %+v %v", msgs, err)
+	}
+	if providerCalls != 0 {
+		t.Fatalf("scratch owner work asked the domain provider %d times", providerCalls)
+	}
+
+	// 负面：别的账号读不到这个临时会话（共享授权适配器一律放行也不作数）。
+	if rec := bearerRequest(h, "GET", "/api/projects/"+projectID+"/conversations", "", bobKey); rec.Code != http.StatusNotFound {
+		t.Fatalf("non-owner listed a scratch project: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := bearerRequest(h, "POST", "/api/projects/"+projectID+"/conversations", `{"title":"混入"}`, bobKey); rec.Code != http.StatusNotFound {
+		t.Fatalf("non-owner created a conversation under scratch: %d %s", rec.Code, rec.Body.String())
+	}
+	if err := srv.projectRead(context.Background(), "bob", projectID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("projectRead opened a scratch project for a non-owner: %v", err)
+	}
+	if err := srv.projectWork(context.Background(), "bob", projectID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("projectWork opened a scratch project for a non-owner: %v", err)
+	}
+	// 属主的读面不受共享适配器影响（存储归属即可）。
+	if err := srv.projectRead(context.Background(), "alice", projectID); err != nil {
+		t.Fatalf("scratch owner projectRead: %v", err)
+	}
+	// 普通项目不受影响：provider 说 false 就是 false。
+	normal, err := st.CreateProject("alice", "普通项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := srv.projectWork(context.Background(), "alice", string(normal.ID)); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("normal project bypassed the provider decision: %v", err)
+	}
+}
+
+// TestScratchHasNoKnowledgeBase 知识库是项目域能力：入库与检索两个面都 400。
+func TestScratchHasNoKnowledgeBase(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, projectID, _ := scratchGateFixture(t, srv, st, "alice")
+	grantProjectCreateFixture(t, st, "alice")
+	normal := createdProjectID(t, bearerRequest(h, "POST", "/api/projects", `{"name":"普通项目"}`, key))
+	doc := `[{"title":"手动文档","chunk":"知识库内容"}]`
+
+	for name, path := range map[string]string{"scratch": projectID, "normal": normal} {
+		rec := bearerRequest(h, "POST", "/api/projects/"+path+"/knowledge", doc, key)
+		switch name {
+		case "scratch":
+			if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "scratch sessions have no knowledge base") {
+				t.Fatalf("addKnowledge on scratch = %d %s", rec.Code, rec.Body.String())
+			}
+		case "normal":
+			if rec.Code != http.StatusOK {
+				t.Fatalf("addKnowledge on a normal project = %d %s", rec.Code, rec.Body.String())
+			}
+		}
+	}
+	// 被拒的写入没有落库。
+	if docs, err := st.SearchKnowledge("alice", core.RetrievalQuery{ProjectID: projectID, Text: "手动文档", TopK: 10}); err != nil || len(docs) != 0 {
+		t.Fatalf("scratch project kept knowledge rows: %+v %v", docs, err)
+	}
+
+	rec := bearerRequest(h, "GET", "/api/knowledge/search?q=知识库&project="+projectID, "", key)
+	if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "scratch sessions have no knowledge base") {
+		t.Fatalf("searchKnowledge on scratch = %d %s", rec.Code, rec.Body.String())
+	}
+	// 正面：普通项目仍然检索得到自己刚入库的文档。
+	if rec := bearerRequest(h, "GET", "/api/knowledge/search?q=知识库&project="+normal, "", key); rec.Code != http.StatusOK {
+		t.Fatalf("searchKnowledge on a normal project = %d %s", rec.Code, rec.Body.String())
+	}
+	// 无 project 参数的全局检索不受门禁影响（它本来就不落在临时会话上）。
+	if rec := bearerRequest(h, "GET", "/api/knowledge/search?q=知识库", "", key); rec.Code != http.StatusOK {
+		t.Fatalf("global search = %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestScratchUploadStaysOutOfKnowledgeIndex 上传仍可用（对话附件），但临时会话的
+// 附件不进任何知识索引；普通项目的上传照旧入库。
+func TestScratchUploadStaysOutOfKnowledgeIndex(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, projectID, _ := scratchGateFixture(t, srv, st, "alice")
+	grantProjectCreateFixture(t, st, "alice")
+	normal := createdProjectID(t, bearerRequest(h, "POST", "/api/projects", `{"name":"普通项目"}`, key))
+
+	upload := func(projectID, name, text string) string {
+		var buf bytes.Buffer
+		mw := multipart.NewWriter(&buf)
+		fw, err := mw.CreateFormFile("file", name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := fw.Write([]byte(text)); err != nil {
+			t.Fatal(err)
+		}
+		mw.Close()
+		req := httptest.NewRequest(http.MethodPost, "/api/projects/"+projectID+"/uploads", &buf)
+		req.Header.Set("Authorization", "Bearer "+key)
+		req.Header.Set("Content-Type", mw.FormDataContentType())
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("upload to %s: %d %s", projectID, rec.Code, rec.Body.String())
+		}
+		var up struct {
+			ArtifactID string `json:"artifactId"`
+		}
+		if err := json.Unmarshal(rec.Body.Bytes(), &up); err != nil {
+			t.Fatal(err)
+		}
+		return up.ArtifactID
+	}
+
+	scratchArtifact := upload(projectID, "临时附件.txt", "临时会话的附件正文")
+	if scratchArtifact == "" {
+		t.Fatal("scratch upload returned no artifact")
+	}
+	upload(normal, "普通附件.txt", "普通项目的附件正文")
+
+	scratchHits, err := st.SearchKnowledge("alice", core.RetrievalQuery{ProjectID: projectID, Text: "附件", TopK: 10})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, hit := range scratchHits {
+		if string(hit.Doc.ProjectID) == projectID || hit.Doc.Ref == scratchArtifact {
+			t.Fatalf("scratch upload was indexed: %+v", hit.Doc)
+		}
+	}
+	normalHits, err := st.SearchKnowledge("alice", core.RetrievalQuery{ProjectID: normal, Text: "附件", TopK: 10})
+	if err != nil || len(normalHits) == 0 {
+		t.Fatalf("normal project upload lost indexing: %+v %v", normalHits, err)
+	}
+}
+
+// TestScratchRejectsDomainCommands 临时会话里 rdm.* 命令 403；不碰项目域的内置
+// 命令照旧可用（它就是普通聊天能力）。
+func TestScratchRejectsDomainCommands(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, projectID, conversationID := scratchGateFixture(t, srv, st, "alice")
+	grantProjectCreateFixture(t, st, "alice")
+	normal := createdProjectID(t, bearerRequest(h, "POST", "/api/projects", `{"name":"普通项目"}`, key))
+	normalConv := createdProjectID(t, bearerRequest(h, "POST", "/api/projects/"+normal+"/conversations", `{"title":"会话"}`, key))
+
+	srv.Bus = cmdbus.New(st, nil, func() time.Time { return time.Now() })
+	srv.WireBuiltinCommands()
+	if err := srv.Bus.RegisterPluginCommand(agentcommand.CommandSpec{ID: "rdm.reqs.add", Title: "登记需求"}, func(ctx context.Context, req cmdbus.Request) (any, error) {
+		return map[string]any{"ok": true}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := srv.Bus.RegisterPluginCommand(agentcommand.CommandSpec{ID: "rdm.reqs.list", Title: "需求列表"}, func(ctx context.Context, req cmdbus.Request) (any, error) {
+		return map[string]any{"ok": true}, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// API 入口（POST /api/commands/{id}）：临时会话宿主一律 403。
+	for _, id := range []string{"rdm.reqs.add", "rdm.reqs.list"} {
+		rec := bearerRequest(h, "POST", "/api/commands/"+id, `{"conversationId":"`+conversationID+`"}`, key)
+		if rec.Code != http.StatusForbidden || !strings.Contains(rec.Body.String(), "not available in scratch sessions") {
+			t.Fatalf("%s on a scratch host = %d %s", id, rec.Code, rec.Body.String())
+		}
+	}
+	// 正面：读侧命令在普通项目宿主上照旧分发。
+	if rec := bearerRequest(h, "POST", "/api/commands/rdm.reqs.list", `{"conversationId":"`+normalConv+`"}`, key); rec.Code != http.StatusOK {
+		t.Fatalf("rdm.reqs.list on a normal host = %d %s", rec.Code, rec.Body.String())
+	}
+	// 没有会话就没有基座项目：门禁不适用，命令走原路径（正式项目命令仍由总线预检拒绝）。
+	if rec := bearerRequest(h, "POST", "/api/commands/rdm.reqs.list", `{}`, key); rec.Code != http.StatusOK {
+		t.Fatalf("command without a host project = %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := bearerRequest(h, "POST", "/api/commands/rdm.reqs.add", `{}`, key); rec.Code != http.StatusBadRequest {
+		t.Fatalf("hostless formal command must keep the bus preflight answer: %d %s", rec.Code, rec.Body.String())
+	}
+	// 内置会话命令在临时会话里照旧可用（它不碰项目域）。
+	rec := bearerRequest(h, "POST", "/api/conversations/"+conversationID+"/messages", `{"text":"/help"}`, key)
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "command") {
+		t.Fatalf("builtin host command in a scratch session = %d %s", rec.Code, rec.Body.String())
+	}
+	if !store.IsScratchProject(mustScratchSettings(t, st, projectID)) {
+		t.Fatalf("scratch marker lost during command gating: %s", projectID)
+	}
+}
+
+func mustScratchSettings(t *testing.T, st *store.Store, projectID string) map[string]any {
+	t.Helper()
+	p, err := st.ProjectMetadata(projectID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return p.Settings
+}
+
+// TestScratchProjectPatchAllowsNameOnly 临时会话只允许改名；任何设置写入 400。
+func TestScratchProjectPatchAllowsNameOnly(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, projectID, _ := scratchGateFixture(t, srv, st, "alice")
+	grantProjectCreateFixture(t, st, "alice")
+
+	if rec := bearerRequest(h, "PATCH", "/api/projects/"+projectID, `{"name":"改个名字"}`, key); rec.Code != http.StatusOK {
+		t.Fatalf("rename scratch project = %d %s", rec.Code, rec.Body.String())
+	}
+	if p, err := st.ProjectMetadata(projectID); err != nil || p.Name != "改个名字" {
+		t.Fatalf("scratch project not renamed: %+v %v", p, err)
+	}
+	for _, body := range []string{`{"settings":{"note":"任何设置"}}`, `{"settings":{"crossSession":{"read":true}}}`, `{"settings":{"host":{"kind":"normal"}}}`} {
+		rec := bearerRequest(h, "PATCH", "/api/projects/"+projectID, body, key)
+		if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "scratch sessions have no project settings") {
+			t.Fatalf("scratch settings patch %s = %d %s", body, rec.Code, rec.Body.String())
+		}
+	}
+	if !store.IsScratchProject(mustScratchSettings(t, st, projectID)) {
+		t.Fatal("refused patch changed the scratch marker")
+	}
+	// 正面：普通项目的设置写入照旧放行。
+	normal := createdProjectID(t, bearerRequest(h, "POST", "/api/projects", `{"name":"普通项目"}`, key))
+	if rec := bearerRequest(h, "PATCH", "/api/projects/"+normal, `{"settings":{"note":"普通"}}`, key); rec.Code != http.StatusOK {
+		t.Fatalf("normal settings patch = %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestDeletingScratchConversationRemovesScratchProject 删会话即删临时会话外壳；
+// 普通项目删会话仍保留项目。
+func TestDeletingScratchConversationRemovesScratchProject(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key, projectID, conversationID := scratchGateFixture(t, srv, st, "alice")
+	grantProjectCreateFixture(t, st, "alice")
+	normal := createdProjectID(t, bearerRequest(h, "POST", "/api/projects", `{"name":"普通项目"}`, key))
+	normalConv := createdProjectID(t, bearerRequest(h, "POST", "/api/projects/"+normal+"/conversations", `{"title":"会话"}`, key))
+
+	bobKey := scratchAccountKey(t, st, "bob")
+	if rec := bearerRequest(h, "DELETE", "/api/conversations/"+conversationID, "", bobKey); rec.Code == http.StatusOK {
+		t.Fatalf("non-owner deleted a scratch conversation: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := bearerRequest(h, "DELETE", "/api/conversations/"+conversationID, "", key); rec.Code != http.StatusOK {
+		t.Fatalf("delete scratch conversation = %d %s", rec.Code, rec.Body.String())
+	}
+	if _, err := st.ProjectMetadata(projectID); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("scratch project survived its conversation: %v", err)
+	}
+	if rec := bearerRequest(h, "DELETE", "/api/conversations/"+normalConv, "", key); rec.Code != http.StatusOK {
+		t.Fatalf("delete normal conversation = %d %s", rec.Code, rec.Body.String())
+	}
+	if _, err := st.ProjectMetadata(normal); err != nil {
+		t.Fatalf("normal project removed with its conversation: %v", err)
+	}
+}

internal/server/scratch_session.go

@@ -0,0 +1,118 @@
+package server
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+
+	"agent-system-backend/internal/cmdbus"
+	"agent-system-backend/internal/store"
+	core "agent-system-core"
+)
+
+// 临时会话入口（U1）：POST /api/scratch-sessions。
+//
+// 能力是内生的——任何已启用账号都能建，不需要 project.create，也不在权限目录
+// /replaceRolePermissions 里出现为可配置项。项目与会话由 store 在一个事务里
+// 写出（scratch 标记 + cross_private 会话），不经过 RDM/projectLifecycle。
+
+// scratchSessionView 是创建结果：调用方同时拿到 scratch 项目与它唯一的会话。
+// 会话走 server 本地的 conversationView：刚建出来的会话必然属于 scratch 项目，
+// 标记直接置真，不必回查。
+type scratchSessionView struct {
+	Project      core.Project     `json:"project"`
+	Conversation conversationView `json:"conversation"`
+}
+
+func (s *Server) createScratchSession(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Name      string         `json:"name"`
+		Title     string         `json:"title"`
+		ProfileID string         `json:"profileId"`
+		Settings  map[string]any `json:"settings"`
+	}
+	// 请求体可省略：空体即默认名临时会话。非空体必须是单一 JSON 对象。
+	if err := json.NewDecoder(io.LimitReader(r.Body, 1<<20)).Decode(&req); err != nil && !errors.Is(err, io.EOF) {
+		http.Error(w, "invalid scratch session request", http.StatusBadRequest)
+		return
+	}
+	// 标记归服务端所有：客户端不能带 settings 上来（哪怕是别的键），
+	// 否则“scratch 标记”会变成一个客户端可写的项目字段。
+	if req.Settings != nil {
+		http.Error(w, "scratch host marker is server-owned", http.StatusBadRequest)
+		return
+	}
+	name := strings.TrimSpace(req.Name)
+	if name == "" {
+		name = store.ScratchDefaultProjectName
+	}
+	title := strings.TrimSpace(req.Title)
+	if title == "" {
+		title = "新会话"
+	}
+	// 与其它 create 路径一致：认证关闭（嵌入式档）走默认租户，认证开启时由
+	// store 的账号有效性边界拒绝停用账号——scratch 不是绕过账号状态的旁路。
+	project, conversation, err := s.st.CreateScratchSessionAccountChecked(
+		s.owner(r), name, title, strings.TrimSpace(req.ProfileID), s.Auth == nil || !s.Auth.Enabled)
+	if err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	// 状态码随同类创建入口（POST /api/projects、/api/projects/{id}/conversations）：
+	// 200 配 writeJSON，而不是 201。
+	writeJSON(w, http.StatusOK, scratchSessionView{
+		Project:      project,
+		Conversation: conversationView{Conversation: conversation, Scratch: true},
+	})
+}
+
+// ---- U2：隔离门禁 ----
+//
+// 临时会话是“只属于自己的通用代理会话”：没有知识库、没有项目上下文、不与任何
+// 会话共享材料。这些门禁只认存储里的 host 标记（store.IsScratchProject），调用点
+// 不自己比对标记字符串。
+
+const (
+	// scratchNoKnowledge 知识库是项目域能力，临时会话一律没有。
+	scratchNoKnowledge = "scratch sessions have no knowledge base"
+	// scratchNoSettings 临时会话只有会话，没有可写的项目设置。
+	scratchNoSettings = "scratch sessions have no project settings"
+	// scratchNoCommand 项目域命令（RDM 及其它需要基座项目的命令）在临时会话不可用。
+	scratchNoCommand = "not available in scratch sessions"
+)
+
+// scratchProjectOf reports whether projectID is the caller's own scratch project.
+// Other owners' projects (and unknown ids) fall through to the normal decision
+// path, so the gate never leaks the existence of someone else's scratch session.
+func (s *Server) scratchProjectOf(projectID, owner string) bool {
+	if s.st == nil {
+		return false
+	}
+	handled, err := s.st.ScratchProjectDecision(projectID, owner)
+	return handled && err == nil
+}
+
+// refuseScratchProjectCapability 门禁拒绝：只对调用者自己的临时会话生效。
+func (s *Server) refuseScratchProjectCapability(w http.ResponseWriter, projectID, owner, message string) bool {
+	if !s.scratchProjectOf(projectID, owner) {
+		return false
+	}
+	http.Error(w, message, http.StatusBadRequest)
+	return true
+}
+
+// refuseScratchCommandHost 命令门禁（403）：临时会话里不得分发需要基座项目的命令。
+// rdm.* 全族与正式项目命令（cmdbus.RequiresProjectWorkDecision）都不行；内置的
+// 会话类命令照旧可用。
+func (s *Server) refuseScratchCommandHost(w http.ResponseWriter, hostProjectID, owner, commandID string) bool {
+	if !s.scratchProjectOf(hostProjectID, owner) {
+		return false
+	}
+	if !strings.HasPrefix(commandID, "rdm.") && !cmdbus.RequiresProjectWorkDecision(commandID) {
+		return false
+	}
+	http.Error(w, scratchNoCommand, http.StatusForbidden)
+	return true
+}

internal/server/scratch_session_test.go

@@ -0,0 +1,311 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+
+	"agent-system-backend/internal/authz/catalog"
+	"agent-system-backend/internal/store"
+)
+
+// 临时会话（U1）HTTP 契约：POST /api/scratch-sessions 对任何已启用账号内生可用，
+// 不经 project.create；scratch 项目不进项目列表但会话仍出现在任务列表；1:1、
+// 标记只归服务端、目录里没有可配置动作。
+
+type scratchSessionHTTPView struct {
+	Project struct {
+		ID       string         `json:"id"`
+		Name     string         `json:"name"`
+		Settings map[string]any `json:"settings"`
+	} `json:"project"`
+	Conversation struct {
+		ID             string `json:"id"`
+		ProjectID      string `json:"projectId"`
+		Title          string `json:"title"`
+		CrossPrivate   bool   `json:"crossPrivate"`
+		AllowCrossRead bool   `json:"allowCrossRead"`
+	} `json:"conversation"`
+}
+
+func decodeScratchSessionHTTP(t *testing.T, rec *httptest.ResponseRecorder) scratchSessionHTTPView {
+	t.Helper()
+	var view scratchSessionHTTPView
+	if err := json.Unmarshal(rec.Body.Bytes(), &view); err != nil {
+		t.Fatalf("decode scratch session: %v body=%s", err, rec.Body.String())
+	}
+	return view
+}
+
+func projectIDsOf(t *testing.T, rec *httptest.ResponseRecorder) []string {
+	t.Helper()
+	var rows []struct {
+		ID string `json:"id"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &rows); err != nil {
+		t.Fatalf("decode projects: %v body=%s", err, rec.Body.String())
+	}
+	out := make([]string, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, row.ID)
+	}
+	return out
+}
+
+func conversationIDsOf(t *testing.T, rec *httptest.ResponseRecorder) []string {
+	t.Helper()
+	var rows []struct {
+		ID string `json:"id"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &rows); err != nil {
+		t.Fatalf("decode conversations: %v body=%s", err, rec.Body.String())
+	}
+	out := make([]string, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, row.ID)
+	}
+	return out
+}
+
+func containsString(values []string, want string) bool {
+	for _, value := range values {
+		if value == want {
+			return true
+		}
+	}
+	return false
+}
+
+func createdProjectID(t *testing.T, rec *httptest.ResponseRecorder) string {
+	t.Helper()
+	var project struct {
+		ID string `json:"id"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &project); err != nil || project.ID == "" {
+		t.Fatalf("decode project: %v body=%s", err, rec.Body.String())
+	}
+	return project.ID
+}
+
+// scratchAccountKey 造一个没有密码的普通账号并签发 API key（与 role_authorization_test 同款）。
+func scratchAccountKey(t *testing.T, st *store.Store, owner string) string {
+	t.Helper()
+	if err := st.CreateAccount(owner, owner, "", false); err != nil {
+		t.Fatal(err)
+	}
+	key, err := st.CreateAPIKey(owner, owner+"-scratch")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key
+}
+
+// TestScratchSessionNeedsNoProjectCreatePermission 是 U1 的核心契约：没有
+// project.create 的已启用账号照样能建临时会话，而同一个账号仍然建不了普通项目。
+// 状态码沿用同类创建入口的 200（writeJSON），不是 201。
+func TestScratchSessionNeedsNoProjectCreatePermission(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	key := scratchAccountKey(t, st, "engineer")
+
+	if allowed, _, reason := systemDecisionFixture(t, bearerRequest(h, "GET", "/api/authz/explain?action=project.create", "", key)); allowed || reason != "not-granted" {
+		t.Fatalf("fixture must not hold project.create: allowed=%v reason=%s", allowed, reason)
+	}
+	if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"普通项目"}`, key); rec.Code != http.StatusForbidden {
+		t.Fatalf("project created without project.create: %d %s", rec.Code, rec.Body.String())
+	}
+
+	rec := bearerRequest(h, "POST", "/api/scratch-sessions", `{}`, key)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("scratch session denied without project.create: %d %s", rec.Code, rec.Body.String())
+	}
+	view := decodeScratchSessionHTTP(t, rec)
+	if !store.IsScratchProject(view.Project.Settings) || view.Project.ID == "" {
+		t.Fatalf("scratch project marker missing: %s", rec.Body.String())
+	}
+	if view.Project.Name == "" || view.Conversation.ID == "" || view.Conversation.ProjectID != view.Project.ID {
+		t.Fatalf("incomplete scratch session: %s", rec.Body.String())
+	}
+	if !view.Conversation.CrossPrivate || !view.Conversation.AllowCrossRead {
+		t.Fatalf("scratch conversation flags: %s", rec.Body.String())
+	}
+
+	// 项目列表里没有 scratch，会话列表与项目会话列表里都有它。
+	projects := bearerRequest(h, "GET", "/api/projects", "", key)
+	if projects.Code != http.StatusOK || containsString(projectIDsOf(t, projects), view.Project.ID) {
+		t.Fatalf("scratch project listed as a normal project: %d %s", projects.Code, projects.Body.String())
+	}
+	tasks := bearerRequest(h, "GET", "/api/conversations", "", key)
+	if tasks.Code != http.StatusOK || !containsString(conversationIDsOf(t, tasks), view.Conversation.ID) {
+		t.Fatalf("scratch conversation missing from task list: %d %s", tasks.Code, tasks.Body.String())
+	}
+	under := bearerRequest(h, "GET", "/api/projects/"+view.Project.ID+"/conversations", "", key)
+	if under.Code != http.StatusOK || len(conversationIDsOf(t, under)) != 1 {
+		t.Fatalf("scratch project conversations: %d %s", under.Code, under.Body.String())
+	}
+
+	// 1:1：第二个会话被拒；普通项目下的会话创建不受影响。
+	second := bearerRequest(h, "POST", "/api/projects/"+view.Project.ID+"/conversations", `{"title":"第二个"}`, key)
+	if second.Code != http.StatusConflict || !strings.Contains(second.Body.String(), "scratch") {
+		t.Fatalf("second conversation under scratch project: %d %s", second.Code, second.Body.String())
+	}
+	after := bearerRequest(h, "GET", "/api/projects/"+view.Project.ID+"/conversations", "", key)
+	if len(conversationIDsOf(t, after)) != 1 {
+		t.Fatalf("refused create still wrote a conversation: %s", after.Body.String())
+	}
+	normal, err := st.CreateProjectAccountChecked("engineer", "普通项目", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rec := bearerRequest(h, "POST", "/api/projects/"+string(normal.ID)+"/conversations", `{"title":"普通会话"}`, key); rec.Code != http.StatusOK {
+		t.Fatalf("normal project lost conversation create: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestScratchSessionCreateForProjectCreateHolder 覆盖另一侧：已经持有
+// project.create 的账号走同一条内生路径，不需要额外的开关。
+func TestScratchSessionCreateForProjectCreateHolder(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	superAdmin := bootSuperAdmin(t, h, st)
+	key := scratchAccountKey(t, st, "creator")
+	createAssignedRoleFixture(t, h, st, superAdmin, "creator", "项目创建者", true)
+	if allowed, source, _ := systemDecisionFixture(t, bearerRequest(h, "GET", "/api/authz/explain?action=project.create", "", key)); !allowed || source != "role" {
+		t.Fatalf("fixture must hold project.create: allowed=%v source=%s", allowed, source)
+	}
+
+	rec := bearerRequest(h, "POST", "/api/scratch-sessions", `{"name":"方案草稿","title":"临时会话"}`, key)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("scratch session denied for project creator: %d %s", rec.Code, rec.Body.String())
+	}
+	view := decodeScratchSessionHTTP(t, rec)
+	if !store.IsScratchProject(view.Project.Settings) || view.Project.Name != "方案草稿" || view.Conversation.Title != "临时会话" {
+		t.Fatalf("scratch session body: %s", rec.Body.String())
+	}
+	// 显式空体同样可用（默认名）。
+	if rec := bearerRequest(h, "POST", "/api/scratch-sessions", ``, key); rec.Code != http.StatusOK {
+		t.Fatalf("empty scratch body: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestScratchSessionCreateRejectsDisabledAccount 停用账号既进不来（凭证被撤），
+// 也不会绕过账号状态写出项目。
+func TestScratchSessionCreateRejectsDisabledAccount(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	admin := bootAdmin(t, h, st)
+	key := scratchAccountKey(t, st, "disabled")
+	account, err := st.GetAccountByOwner("disabled")
+	if err != nil {
+		t.Fatal(err)
+	}
+	state := do(h, "PUT", "/api/admin/users/"+account.ID+"/state",
+		`{"expectedStateVersion":`+strconv.FormatInt(account.StateVersion, 10)+`,"enabled":false}`, admin)
+	if state.Code != http.StatusOK {
+		t.Fatalf("disable account: %d %s", state.Code, state.Body.String())
+	}
+
+	rec := bearerRequest(h, "POST", "/api/scratch-sessions", `{}`, key)
+	// 停用会消费已有凭证，所以请求在认证中间件就被拒（401）；即使凭证仍在，
+	// store 的账号有效性边界也会返回 403——两条路径都不写项目。
+	if rec.Code != http.StatusUnauthorized && rec.Code != http.StatusForbidden {
+		t.Fatalf("disabled account scratch create: unexpected status %d %s", rec.Code, rec.Body.String())
+	}
+	if rec.Code == http.StatusUnauthorized && !strings.Contains(rec.Body.String(), "revoked") {
+		t.Fatalf("disabled account scratch create: %d %s", rec.Code, rec.Body.String())
+	}
+	if _, _, err := st.CreateScratchSessionAccountChecked("disabled", "临时会话", "临时会话", "", false); err == nil {
+		t.Fatal("disabled account reached the scratch create past the account fence")
+	}
+	if projects, err := st.ListProjects("disabled"); err != nil || len(projects) != 0 {
+		t.Fatalf("disabled account left a project row: %+v %v", projects, err)
+	}
+}
+
+// TestScratchMarkerIsServerOwned 客户端既不能在普通项目上加标记，也不能从
+// scratch 项目上摘掉，更不能借 POST /api/projects 直接造一个 scratch。
+func TestScratchMarkerIsServerOwned(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	superAdmin := bootSuperAdmin(t, h, st)
+	key := scratchAccountKey(t, st, "creator")
+	createAssignedRoleFixture(t, h, st, superAdmin, "creator", "项目创建者", true)
+
+	normal := bearerRequest(h, "POST", "/api/projects", `{"name":"普通项目"}`, key)
+	if normal.Code != http.StatusOK {
+		t.Fatalf("create project: %d %s", normal.Code, normal.Body.String())
+	}
+	normalID := createdProjectID(t, normal)
+	scratch := bearerRequest(h, "POST", "/api/scratch-sessions", `{}`, key)
+	if scratch.Code != http.StatusOK {
+		t.Fatalf("create scratch: %d %s", scratch.Code, scratch.Body.String())
+	}
+	scratchID := decodeScratchSessionHTTP(t, scratch).Project.ID
+
+	if rec := bearerRequest(h, "PATCH", "/api/projects/"+normalID, `{"settings":{"host":{"kind":"scratch"}}}`, key); rec.Code != http.StatusBadRequest {
+		t.Fatalf("patch added the scratch marker: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := bearerRequest(h, "PATCH", "/api/projects/"+scratchID, `{"settings":{"host":{"kind":"normal"}}}`, key); rec.Code != http.StatusBadRequest {
+		t.Fatalf("patch cleared the scratch marker: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"伪 scratch","settings":{"host":{"kind":"scratch"}}}`, key); rec.Code != http.StatusBadRequest {
+		t.Fatalf("POST /api/projects created a scratch: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := bearerRequest(h, "POST", "/api/scratch-sessions", `{"settings":{"host":{"kind":"scratch"}}}`, key); rec.Code != http.StatusBadRequest {
+		t.Fatalf("scratch endpoint accepted client settings: %d %s", rec.Code, rec.Body.String())
+	}
+	// 不改标记的普通设置写入照旧放行。
+	if rec := bearerRequest(h, "PATCH", "/api/projects/"+normalID, `{"settings":{"note":"保留"}}`, key); rec.Code != http.StatusOK {
+		t.Fatalf("unrelated settings patch refused: %d %s", rec.Code, rec.Body.String())
+	}
+	// 被拒的写入没有落库：普通项目仍然不是 scratch。
+	stored, err := st.GetProject("creator", normalID)
+	if err != nil || store.IsScratchProject(stored.Settings) {
+		t.Fatalf("rejected patch changed the marker: %+v %v", stored.Settings, err)
+	}
+}
+
+// TestScratchIsNotAConfigurablePermission 权限目录与 replaceRolePermissions
+// 都没有 scratch 创建动作：能力内生，不可授予也不可撤销。
+func TestScratchIsNotAConfigurablePermission(t *testing.T) {
+	srv, st := newAuthTestServer(t)
+	h := srv.Handler()
+	admin := bootAdmin(t, h, st)
+	viewerKey := scratchAccountKey(t, st, "viewer")
+
+	rec := do(h, "GET", "/api/admin/permissions/catalog", "", admin)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("catalog: %d %s", rec.Code, rec.Body.String())
+	}
+	for _, descriptor := range catalog.Catalog() {
+		if strings.Contains(strings.ToLower(descriptor.ActionID), "scratch") {
+			t.Fatalf("catalog exposes a scratch action: %s", descriptor.ActionID)
+		}
+	}
+	if strings.Contains(rec.Body.String(), "scratch") {
+		t.Fatalf("catalog body mentions scratch: %s", rec.Body.String())
+	}
+
+	roleRec := do(h, "POST", "/api/admin/roles", `{"name":"临时会话职位"}`, admin)
+	if roleRec.Code != http.StatusOK {
+		t.Fatalf("create role: %d %s", roleRec.Code, roleRec.Body.String())
+	}
+	role := decodeRoleHTTP(t, roleRec)
+	for _, actionID := range []string{"project.scratch.create", "scratch.create", "scratch.session.create"} {
+		body := `{"expectedRoleVersion":1,"idempotencyKey":"scratch-action","changes":[{"actionId":"` + actionID + `","allowed":true,"capAllowed":true}]}`
+		if rec := do(h, "PUT", "/api/admin/roles/"+role.RoleID+"/permissions", body, admin); rec.Code != http.StatusBadRequest {
+			t.Fatalf("role policy accepted %s: %d %s", actionID, rec.Code, rec.Body.String())
+		}
+	}
+	view := do(h, "GET", "/api/admin/roles/"+role.RoleID, "", admin)
+	if strings.Contains(view.Body.String(), "scratch") {
+		t.Fatalf("role view mentions scratch: %s", view.Body.String())
+	}
+	me := bearerRequest(h, "GET", "/api/me", "", viewerKey)
+	if me.Code != http.StatusOK || strings.Contains(me.Body.String(), "scratch") {
+		t.Fatalf("me mentions a scratch capability: %d %s", me.Code, me.Body.String())
+	}
+}

internal/server/server.go

@@ -19,6 +19,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	agentcommand "agent-command"
@@ -71,6 +72,11 @@ type Server struct {
 	set       *settings.Service
 	plugins   *plugins.Host
 	static    fs.FS
+	// 会话语义的端口（A1/U-A1b）：chat 入口折叠「动作可执行但槽位未就绪」的
+	// 挂起预期。nil = 按存储惰性装配（intentsession.New）；组合根/测试可
+	// 注入替身，见 SetIntentSessionService。
+	sessionsMu sync.Mutex
+	sessions   IntentSessions
 	// Subscribe 注入 bus 订阅（事件在线转发；重放走 store 游标）。
 	Subscribe func(conversationID string) (<-chan core.StreamEvent, func())
 	// DisableUploadIndexing EXT-9：true 时上传端点不再自动写检索索引（原件与
@@ -140,6 +146,9 @@ func (s *Server) authorizeProjectAction(owner string, projectID core.ID, action
 // Owner/ProjectID 从受信存储元数据解析；出错/字段缺失一律 false，fail-closed
 // 且不泄露存在性）；V2 未注册回落 authorizeSharedProject（现行兼容）。
 func (s *Server) authorizeSharedResource(actor, action, resourceType string, resourceID, owner, projectID core.ID) bool {
+	if s.sharedScratchDenied(actor, projectID) {
+		return false
+	}
 	if s.ProjectAuthzV2 == nil {
 		return s.authorizeSharedProject(actor, projectID)
 	}
@@ -164,10 +173,24 @@ func (s *Server) authorizeSharedProject(owner string, projectID core.ID) bool {
 	if s.ProjectAuthz == nil {
 		return false
 	}
+	if s.sharedScratchDenied(owner, projectID) {
+		return false
+	}
 	ok, err := s.ProjectAuthz(owner, projectID)
 	return err == nil && ok
 }
 
+// sharedScratchDenied 保证共享域授权永远打不开临时会话：临时会话是私有的
+// 1:1 会话外壳，不是共享资源，EXT-8/EXT-8b 适配器不得为他人授予它。属主
+// 不受影响（属主的读写按存储归属判定）。
+func (s *Server) sharedScratchDenied(actor string, projectID core.ID) bool {
+	if s.st == nil || projectID == "" {
+		return false
+	}
+	handled, err := s.st.ScratchProjectDecision(string(projectID), actor)
+	return handled && err != nil
+}
+
 func New(st *store.Store, mgr *runmgr.Manager, reg *tools.Registry, p *profiles.Service, s *settings.Service, ph *plugins.Host) *Server {
 	sub, err := web.Dist()
 	if err != nil {
@@ -197,11 +220,14 @@ func (s *Server) recognize(ctx context.Context, text string) intentgate.MatchRes
 
 // WireBuiltinCommands 注册内置命令（`/` 菜单全清单的数据源；处理器为宿主用例适配）。
 // 响应保持既有 {command, ...} 契约（frontend store.sendMessage 按此消费）。
+// 组合根在注入 Bus 之后调用一次（启动期）；此处也是 operationID 对账查询端口的
+// 装配点：总线只在启动时刻拿到宿主端口，不在请求路径上改写总线状态。
 func (s *Server) WireBuiltinCommands() {
 	b := s.Bus
 	if b == nil {
 		return
 	}
+	b.SetOperationQuery(commandOperationQuery{st: s.st})
 	must := func(err error) {
 		if err != nil {
 			panic("server: builtin command: " + err.Error()) // 装配期错误属编程错误
@@ -334,6 +360,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/capability/explain", s.explainCapability)
 
 	// ---- 项目 / 会话 ----
+	mux.HandleFunc("POST /api/scratch-sessions", s.createScratchSession)
 	mux.HandleFunc("GET /api/projects", s.listProjects)
 	mux.HandleFunc("POST /api/projects", s.createProject)
 	mux.HandleFunc("PATCH /api/projects/{id}", s.patchProject)
@@ -365,6 +392,8 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("DELETE /api/prompt-commands/{id}", s.deleteUserPromptCommand)
 	mux.HandleFunc("POST /api/runs/{id}/cancel", s.cancelRun)
 	mux.HandleFunc("GET /api/runs/{id}", s.getRun)
+	// 只读运行诊断（A2）：卡在哪、谁负责、已知副作用、下一步；无写操作。
+	mux.HandleFunc("GET /api/runs/{id}/diagnostics", s.getRunDiagnostics)
 
 	// ---- HITL ----
 	mux.HandleFunc("POST /api/hitl/{id}/resolve", s.resolveHITL)
@@ -427,6 +456,9 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/workspaces", s.listWorkspaces)
 	mux.HandleFunc("POST /api/commands/{id}", s.execCommand)
 	mux.HandleFunc("GET /api/commands/audit", s.listAudits)
+	// U7b/R7：operationID 对账查询（unknown 回执的收敛入口；owner 取自认证
+	// 上下文，projectId 只收窄作用域）。
+	mux.HandleFunc("GET /api/commands/operations/{operationId}", s.getCommandOperation)
 	mux.HandleFunc("GET /api/parsers", s.listParsers)
 	mux.HandleFunc("POST /api/projects/{id}/knowledge", s.addKnowledge)
 	mux.HandleFunc("GET /api/knowledge/search", s.searchKnowledge)
@@ -710,6 +742,10 @@ func (s *Server) listProjects(w http.ResponseWriter, r *http.Request) {
 		}
 		out := make([]projectView, 0, len(ps))
 		for _, p := range ps {
+			// scratch 项目不作为普通项目出现（provider 列表同样过滤）。
+			if store.IsScratchProject(p.Settings) {
+				continue
+			}
 			out = append(out, projectView{Project: s.publicProjectMetadata(p), Shared: p.Owner != owner})
 		}
 		writeJSON(w, http.StatusOK, out)
@@ -748,12 +784,18 @@ func (s *Server) createProject(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var req struct {
-		Name string `json:"name"`
+		Name     string         `json:"name"`
+		Settings map[string]any `json:"settings"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || strings.TrimSpace(req.Name) == "" {
 		http.Error(w, "name required", http.StatusBadRequest)
 		return
 	}
+	// 普通项目创建路径不能造 scratch：标记只由 POST /api/scratch-sessions 写。
+	if store.IsScratchProject(req.Settings) {
+		http.Error(w, "scratch sessions are created by POST /api/scratch-sessions", http.StatusBadRequest)
+		return
+	}
 	if s.projectLifecycle != nil {
 		if s.projectLifecycle.Create == nil {
 			writeProjectErr(w, store.ErrNotFound)
@@ -769,6 +811,7 @@ func (s *Server) createProject(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) patchProject(w http.ResponseWriter, r *http.Request) {
 	id := r.PathValue("id")
+	owner := s.owner(r)
 	var req struct {
 		Name     *string        `json:"name"`
 		Settings map[string]any `json:"settings"`
@@ -777,6 +820,11 @@ func (s *Server) patchProject(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
 	}
+	// 临时会话只有会话：除了改名没有任何项目设置可写（标记保护之外再加一道）。
+	if req.Settings != nil && s.scratchProjectOf(id, owner) {
+		http.Error(w, scratchNoSettings, http.StatusBadRequest)
+		return
+	}
 	if req.Settings != nil {
 		values, err := s.set.PrepareProjectMetadataWrite(req.Settings)
 		if err != nil {
@@ -861,6 +909,37 @@ func (s *Server) deleteProject(w http.ResponseWriter, r *http.Request) {
 	writeOKOr(w, s.st.DeleteProjectAccountChecked(s.owner(r), r.PathValue("id"), s.Auth == nil || !s.Auth.Enabled))
 }
 
+// conversationView 是下发给前端的会话视图：core.Conversation 原样透出，外加一个
+// 只读的 scratch 标记，供前端把临时会话归到“无项目对话”，不用再从项目列表反推。
+// core.Conversation 在另一个仓库，所以标记只存在于这份 server 本地视图里。
+// 标记 omitempty：普通项目的会话 JSON 与加标记之前逐字节同形。
+type conversationView struct {
+	core.Conversation
+	Scratch bool `json:"scratch,omitempty"`
+}
+
+// scratchProjectSet 读出 owner 的 scratch 项目 id 集合；读不到时按空集处理——
+// 标记只是列表上的附加信息，取不到不改变列表本身（与详情里的辅助查询同款取舍）。
+func (s *Server) scratchProjectSet(owner string) map[string]bool {
+	if s.st == nil {
+		return map[string]bool{}
+	}
+	ids, err := s.st.ScratchProjectIDs(owner)
+	if err != nil {
+		return map[string]bool{}
+	}
+	return ids
+}
+
+// conversationViews 给一批会话打 scratch 标记；返回的每一项与 store 的会话一一对应。
+func (s *Server) conversationViews(scratch map[string]bool, cs []core.Conversation) []conversationView {
+	out := make([]conversationView, 0, len(cs))
+	for _, c := range cs {
+		out = append(out, conversationView{Conversation: c, Scratch: scratch[string(c.ProjectID)]})
+	}
+	return out
+}
+
 func (s *Server) listConversations(w http.ResponseWriter, r *http.Request) {
 	owner := s.owner(r)
 	if s.projectLifecycle != nil {
@@ -876,14 +955,15 @@ func (s *Server) listConversations(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	cs, err := s.st.ListConversations(owner, r.PathValue("id"))
-	writeJSONOr(w, cs, err)
+	writeJSONOr(w, s.conversationViews(s.scratchProjectSet(owner), cs), err)
 }
 
 // listTasks 跨项目任务列表（方案 A 侧栏数据源）：默认仅未归档，?archived=1 含归档。
 func (s *Server) listTasks(w http.ResponseWriter, r *http.Request) {
 	v := r.URL.Query().Get("archived")
-	cs, err := s.st.ListTasks(s.owner(r), v == "1" || v == "true")
-	writeJSONOr(w, cs, err)
+	owner := s.owner(r)
+	cs, err := s.st.ListTasks(owner, v == "1" || v == "true")
+	writeJSONOr(w, s.conversationViews(s.scratchProjectSet(owner), cs), err)
 }
 
 // me 当前身份（阶段 1：API key 即身份，user 即租户 owner；嵌入式档 owner 为默认租户）。
@@ -949,8 +1029,9 @@ func (s *Server) conversationDetail(w http.ResponseWriter, r *http.Request) {
 			resumeSeq = seq - 1
 		}
 	}
+	view := conversationView{Conversation: conv, Scratch: s.scratchProjectSet(owner)[string(conv.ProjectID)]}
 	writeJSON(w, http.StatusOK, map[string]any{
-		"conversation": conv, "messages": msgs, "runs": runs,
+		"conversation": view, "messages": msgs, "runs": runs,
 		"activeHitl": cards, "lastSeq": lastSeq, "resumeSeq": resumeSeq,
 	})
 }
@@ -1156,8 +1237,23 @@ func (s *Server) postMessage(w http.ResponseWriter, r *http.Request) {
 	routeKind := route.KindTurn
 	var recognized intentgate.MatchResult
 	var workflowDef core.WorkflowDef
+	var admission *intentAdmission
+	var clarify *clarifyPayload
+	var sessionNote *intentSessionNote
+	var cancelTarget *route.CancelTarget
+	var cancelRunID string
 	if s.Gate != nil && !strings.HasPrefix(text, "/") && req.TaskRef == nil {
 		recognized = s.recognize(r.Context(), text)
+		// 会话语义（A1/U-A1b）：有挂起预期时先按它折叠本轮——补齐即按与
+		// 一次完整识别完全相同的准入与派发路径执行，仍缺则续挂并如实重新
+		// 澄清，取消则清理会话且不派发。无挂起预期时本段空转（行为不变）。
+		sessionKey := intentSessionKey(owner, conv)
+		fused, sessionOutcome, ferr := s.fuseIntentSession(sessionKey, recognized)
+		if ferr != nil {
+			writeStoreErr(w, ferr)
+			return
+		}
+		recognized = fused
 		dec := route.Decide(recognized, route.Env{
 			HasCommand: func(id string) bool { return s.Bus != nil && s.Bus.HasCommand(id) },
 			WorkflowFor: func(intentID string) (core.WorkflowDef, bool) {
@@ -1167,16 +1263,56 @@ func (s *Server) postMessage(w http.ResponseWriter, r *http.Request) {
 				return s.Workflows.ByIntent(intentID)
 			},
 			// SquadReady 保持 false：per-run entry 覆盖未就位（见 route 包注释的已知边界）。
+			// SessionRun：取消靶子的会话来源（意图会话绑定的运行）；没有绑定
+			// 时返回 false，路由层随即把「取消没有唯一靶子」交给宿主澄清。
+			SessionRun: func() (route.SessionRun, bool) { return s.sessionRunTarget(sessionKey) },
 		})
 		switch dec.Kind {
+		case route.KindCancel:
+			// 取消是既有动作（带明确对象）：靶子唯一且对发起人可见才派发，
+			// 否则如实澄清（绝不猜一个）。本轮不启动新回合——取消与启动互斥。
+			// 会话层已经消费掉本轮 cancel（放弃补槽）时不再二次规划。
+			if sessionOutcome == nil || !sessionOutcome.cancelled {
+				runID, need := s.planIntentCancel(owner, conv, recognized, dec)
+				clarify = need
+				if need == nil {
+					routeKind, cancelTarget, cancelRunID = route.KindCancel, dec.Cancel, runID
+				}
+			}
 		case route.KindCommand:
-			routeKind = route.KindCommand
-			recognized.ID = dec.CommandID
-			recognized.Slots = dec.Slots
+			// 接纳：按命令 DECLARED schema 把槽位映射成参数；准入未过
+			// （必填参数无法由原文+槽位满足）就不派发，降为澄清回合（F09）。
+			adm := admitIntentCommand(s.Bus, dec.CommandID, dec.Slots, text)
+			clarify = newClarifyPayload(recognized, dec, &adm)
+			if !adm.Blocked {
+				routeKind = route.KindCommand
+				recognized.ID = dec.CommandID
+				recognized.Slots = dec.Slots
+				admission = &adm
+			}
 		case route.KindWorkflow:
 			routeKind = route.KindWorkflow
 			workflowDef = dec.Workflow
 			recognized.Slots = dec.Slots
+			clarify = newClarifyPayload(recognized, dec, nil)
+		default:
+			clarify = newClarifyPayload(recognized, dec, nil)
+		}
+		// 动作可执行但槽位未就绪：把这一轮记成会话里的挂起预期，下一轮
+		// 补齐即可按同一准入与派发路径执行（响应面不受影响）。
+		if err := s.suspendIntentSession(sessionKey, recognized, dec, admission); err != nil {
+			writeStoreErr(w, err)
+			return
+		}
+		if sessionOutcome != nil {
+			switch {
+			case sessionOutcome.clarify != nil:
+				// 仍缺槽位：如实按会话的累计状态重新澄清。
+				clarify = sessionOutcome.clarify
+			case sessionOutcome.cancelled:
+				// 取消挂起的补充：如实确认，不派发任何业务动作。
+				sessionNote = sessionOutcome.note
+			}
 		}
 	}
 	claimed := false
@@ -1209,9 +1345,21 @@ func (s *Server) postMessage(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	if routeKind == route.KindCancel {
+		// 取消意图落到既有取消路径（与 POST /api/runs/{id}/cancel 同款）：
+		// 回执、确认卡与会话记录都在响应里如实给出；不启动新回合。
+		s.handleIntentCancel(w, r, conv, msg, cancelTarget, cancelRunID)
+		return
+	}
 	if routeKind == route.KindCommand {
+		// 参数按命令 DECLARED schema 映射（槽位→声明键/声明类型）；原文恒供。
+		params := map[string]any{chatTextParam: text}
+		if admission != nil && admission.Params != nil {
+			params = admission.Params
+			params[chatTextParam] = text
+		}
 		resp := s.Bus.Dispatch(r.Context(), cmdbus.Request{
-			ID: recognized.ID, Params: map[string]any{"text": text}, Entrance: "chat", Actor: owner,
+			ID: recognized.ID, Params: params, Entrance: "chat", Actor: owner,
 			Owner: owner, ConversationID: convID, AnchorMessageID: msg.ID, HostProjectID: string(conv.ProjectID),
 		})
 		out := map[string]any{"message": msg, "receipt": resp.Receipt, "command": recognized.ID}
@@ -1248,7 +1396,17 @@ func (s *Server) postMessage(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	msg.RunID = run.ID
-	writeJSON(w, http.StatusOK, map[string]any{"message": msg, "run": run})
+	out := map[string]any{"message": msg, "run": run}
+	if clarify != nil {
+		// 澄清诉求（业务动作未派发）：既有端点上的附加字段，缺失/非法各带结构化原因。
+		out["clarify"] = clarify
+	}
+	if sessionNote != nil {
+		// 会话语义的如实回话（取消挂起的补充）：同样不新增 API 面，且从不
+		// 声称已派发任何业务动作。
+		out["intent_session"] = sessionNote
+	}
+	writeJSON(w, http.StatusOK, out)
 }
 
 // writeExistingMessage 把同一 requestId 的已有消息和仍在进行的 run 原样返回。
@@ -1280,6 +1438,10 @@ func (s *Server) handleCommand(w http.ResponseWriter, r *http.Request, conv core
 		http.Error(w, "未知命令 "+slash+"（/help 查看）", http.StatusBadRequest)
 		return
 	}
+	// 临时会话里没有项目域：rdm.* 与正式项目命令一律 403。
+	if s.refuseScratchCommandHost(w, string(conv.ProjectID), s.owner(r), id) {
+		return
+	}
 	params, err := parseSlashParams(id, fields[1:])
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusBadRequest)
@@ -1363,6 +1525,10 @@ func (s *Server) execCommand(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	}
+	// 基座项目是临时会话时，项目域命令一律 403（无会话上下文的命令不在此门）。
+	if s.refuseScratchCommandHost(w, hostProject, s.owner(r), commandID) {
+		return
+	}
 
 	dispatch := cmdbus.Request{
 		ID: commandID, Params: body.Params, Entrance: body.Entrance, Actor: s.owner(r),
@@ -1412,8 +1578,7 @@ func (s *Server) cancelRun(w http.ResponseWriter, r *http.Request) {
 	// conversation_id 必须回填真实值：消费侧按执行权 JOIN 匹配，空串永远
 	// 无法送达（同批实测）。
 	if s.st.Dialect() == "postgres" && !s.mgr.RunActiveLocally(runID) {
-		if cerr := s.st.EnqueueCommandAccountChecked(s.owner(r), store.NewID("cmd"), "cancel", runID, 0,
-			runmgr.CancelCommandPayload{Owner: s.owner(r), RunID: runID}, s.Auth == nil || !s.Auth.Enabled); cerr != nil {
+		if cerr := s.enqueueCancelCommand(s.owner(r), runID); cerr != nil {
 			writeStoreErr(w, cerr)
 			return
 		}
@@ -1703,7 +1868,9 @@ func (s *Server) upload(w http.ResponseWriter, r *http.Request) {
 	}
 	// 文本可解析的进检索索引（管线分块+全文+可选向量）。
 	// EXT-9：宿主关闭自动索引时跳过（发布决定移交下游命令层；原件与摄取卡不变）。
-	if !s.DisableUploadIndexing {
+	// 临时会话只有会话：附件进入对话，但不进任何知识索引（否则会话材料会
+	// 漏进别的会话的检索结果）。
+	if !s.DisableUploadIndexing && !s.scratchProjectOf(projectID, owner) {
 		if plain := doc.PlainText(); plain != "" && len(plain) < 200000 {
 			var indexErr error
 			if s.Indexer != nil {
@@ -2283,6 +2450,10 @@ func (s *Server) addKnowledge(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	// 知识库是项目域能力：临时会话不接收任何文档入库。
+	if s.refuseScratchProjectCapability(w, r.PathValue("id"), owner, scratchNoKnowledge) {
+		return
+	}
 	for i := range docs {
 		docs[i].Owner = owner
 		docs[i].ProjectID = r.PathValue("id")
@@ -2302,6 +2473,10 @@ func (s *Server) searchKnowledge(w http.ResponseWriter, r *http.Request) {
 	topK, _ := strconv.Atoi(r.URL.Query().Get("topK"))
 	query := core.RetrievalQuery{ProjectID: r.URL.Query().Get("project"), Text: q, TopK: topK}
 	owner := s.owner(r)
+	// 检索面同样先问门禁：临时会话没有知识库（而不是“搜出来是空的”）。
+	if s.refuseScratchProjectCapability(w, query.ProjectID, owner, scratchNoKnowledge) {
+		return
+	}
 	if s.projectLifecycle != nil && query.ProjectID != "" {
 		id, err := projectscope.Resolve(r.Context(), s.lifecycleHost(owner), *s.projectLifecycle, query.ProjectID)
 		if err != nil {
@@ -2409,6 +2584,14 @@ func writeOKOr(w http.ResponseWriter, err error) {
 }
 
 func writeStoreErr(w http.ResponseWriter, err error) {
+	if errors.Is(err, store.ErrScratchMarkerReserved) {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	if errors.Is(err, store.ErrScratchSessionSingle) {
+		http.Error(w, err.Error(), http.StatusConflict)
+		return
+	}
 	if errors.Is(err, store.ErrAccountForbidden) {
 		http.Error(w, err.Error(), http.StatusForbidden)
 		return

internal/server/workflow_route_test.go

@@ -59,10 +59,14 @@ func TestCommandBusBeatsWorkflow(t *testing.T) {
 		t.Fatal(err)
 	}
 	_, convID := setupConversation(t, srv.Handler())
-	code, out := doJSON(t, srv.Handler(), "POST", "/api/conversations/"+convID+"/messages", map[string]any{"text": "写一份简报"})
+	// 槽位齐全才派发命令（F09）：必填槽位缺失时命令不得执行，改走澄清回合。
+	code, out := doJSON(t, srv.Handler(), "POST", "/api/conversations/"+convID+"/messages", map[string]any{"text": "主题：核能 写一份简报"})
 	if code != 200 || out["command"] != "demo.brief" {
 		t.Fatalf("status %d body %v", code, out)
 	}
+	if _, ok := out["clarify"]; ok {
+		t.Fatalf("complete slots must not clarify: %v", out)
+	}
 	if _, ok := out["run"]; ok {
 		t.Fatal("a command hit must not start a workflow run")
 	}

internal/squadadapter/adapter.go

@@ -225,6 +225,11 @@ func isHoldStatus(s string) bool {
 // AgentNativeOptions 可选组合根注入：返回配置且启用时，为每次小队运行注册
 // "agent-native" 内核后端工厂（模型/搜索/执行/MCP/技能根由组合根从 settings
 // 解析；Subagent 工厂经 rc 桥接产品 SpawnSubagent）。
+//
+// 组合根必须按「本次运行」解析配置：模型、端点与密钥整条来自 rc.Settings()
+// 已合并的当前用户/项目快照（叠加 rc 的画像模型覆盖），per-route 规则与直连
+// 共用同一构造器。按默认账号重新解析会让一个用户的模型名配上另一个账号的
+// 端点/密钥。
 var AgentNativeOptions func(rc Ctx) (nativeadp.Config, bool)
 
 // SubagentFactory 把内核委派端口（delegate_task）桥接到产品 SpawnSubagent：

internal/squadadapter/entry.go

@@ -27,7 +27,9 @@ type EntryOptions struct {
 	MaxTurns     int
 	MaxToolCalls int
 	RepairBudget int
-	Model        string
+	// Model 是本次运行的主模型（与 AgentNativeOptions 解析出的路由同源：
+	// 同一份运行快照 + 画像覆盖），不得与工厂配的端点/密钥分属不同属主。
+	Model string
 }
 
 // EntryResult 是入口跑完后的文本。工件登记由调用方在虚假交付检查之后做。

internal/store/intent_session.go

@@ -0,0 +1,166 @@
+package store
+
+// 意图会话（A1/U-A1b）：会话维度挂起一条「可执行动作预期」——动作引用、
+// 仍缺的槽位、已收集的槽位、单调 revision 与到期时间。宿主
+// （internal/intentsession）在澄清回合后写入它，下一轮把用户的补充折叠
+// 回去；槽位齐全时宿主按同一条准入与派发路径执行（授权与高危确认始终
+// 由 cmdbus 收口——本表不携带任何权限字段）。
+//
+// 键是 (owner, project_id, conversation_id)：两个用户、两个项目的会话在
+// 构造上互不可见，读写一律带 owner 过滤。行是运行态（默认 30 分钟后
+// 过期、读侧惰性删除），不进 storage-migrate 的 copyOrder（同
+// admission_leases：进程/会话瞬态，迁移没有意义）。
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// IntentSlotQuestion 是一个仍缺的必填槽位及其建议提问。
+type IntentSlotQuestion struct {
+	Key      string `json:"key"`
+	Question string `json:"question,omitempty"`
+}
+
+// IntentExpectation 是挂起的可执行动作预期：等后续轮次补齐槽位。
+// ActionKind/ActionID 是权威动作引用（command/workflow/blueprint/auto）。
+type IntentExpectation struct {
+	IntentID   string               `json:"intent_id,omitempty"`
+	ActionKind string               `json:"action_kind,omitempty"`
+	ActionID   string               `json:"action_id,omitempty"`
+	Missing    []IntentSlotQuestion `json:"missing,omitempty"`
+	Question   string               `json:"question,omitempty"`
+}
+
+// IntentSession 是一个会话当前的意图会话状态。Expectation=nil 表示当前
+// 没有挂起动作（例如用户已取消或动作已补齐），Slots 保留已收集值，
+// Revision 单调递增用于挡住陈旧回答。
+type IntentSession struct {
+	Owner          string
+	ProjectID      string
+	ConversationID string
+	Expectation    *IntentExpectation
+	Slots          map[string]string
+	Revision       int
+	ExpiresAt      time.Time
+	CreatedAt      time.Time
+	UpdatedAt      time.Time
+}
+
+// GetIntentSession 按 owner+project+conversation 读回意图会话。
+// 没有行（别的用户/项目/会话、或尚未挂起）一律返回 ErrNotFound：
+// 会话状态不跨用户可见，调用方不得据此猜测存在性。
+func (s *Store) GetIntentSession(owner, projectID, conversationID string) (IntentSession, error) {
+	if owner == "" || conversationID == "" {
+		return IntentSession{}, ErrNotFound
+	}
+	row := s.db.QueryRow(s.q(`SELECT expectation,slots,revision,expires_at,created_at,updated_at
+		FROM intent_session WHERE owner=? AND project_id=? AND conversation_id=?`),
+		owner, projectID, conversationID)
+	return scanIntentSession(owner, projectID, conversationID, row)
+}
+
+// PutIntentSession 挂起一个动作预期并累计槽位（upsert，revision 每次 +1、
+// 到期时间每次刷新）。expectation=nil 表示清空挂起动作（保留已收集槽位）。
+// 返回写入后的会话（含新的 revision），调用方据此推进自己的视图。
+func (s *Store) PutIntentSession(owner, projectID, conversationID string,
+	expectation *IntentExpectation, slots map[string]string, ttl time.Duration) (IntentSession, error) {
+	if owner == "" || conversationID == "" {
+		return IntentSession{}, errors.New("store: intent session key incomplete")
+	}
+	var rawExpectation any
+	if expectation != nil {
+		rawExpectation = marshalJSON(expectation)
+	}
+	if slots == nil {
+		slots = map[string]string{}
+	}
+	now := time.Now().UTC()
+	expiresAt := ""
+	if ttl > 0 {
+		expiresAt = now.Add(ttl).Format(time.RFC3339Nano)
+	}
+	if _, err := s.db.Exec(s.q(`INSERT INTO intent_session
+		(owner,project_id,conversation_id,expectation,slots,revision,expires_at,created_at,updated_at)
+		VALUES(?,?,?,?,?,1,?,?,?)
+		ON CONFLICT(owner,project_id,conversation_id) DO UPDATE SET
+			expectation=excluded.expectation, slots=excluded.slots,
+			revision=intent_session.revision+1, expires_at=excluded.expires_at,
+			updated_at=excluded.updated_at`),
+		owner, projectID, conversationID, rawExpectation, marshalJSON(slots),
+		expiresAt, now.Format(time.RFC3339Nano), now.Format(time.RFC3339Nano)); err != nil {
+		return IntentSession{}, fmt.Errorf("put intent session: %w", err)
+	}
+	return s.GetIntentSession(owner, projectID, conversationID)
+}
+
+// ClearIntentSession 删除整行会话状态（幂等；动作已派发或会话结束时用）。
+func (s *Store) ClearIntentSession(owner, projectID, conversationID string) error {
+	if owner == "" || conversationID == "" {
+		return nil
+	}
+	if _, err := s.db.Exec(s.q(`DELETE FROM intent_session WHERE owner=? AND project_id=? AND conversation_id=?`),
+		owner, projectID, conversationID); err != nil {
+		return fmt.Errorf("clear intent session: %w", err)
+	}
+	return nil
+}
+
+// ClearIntentSessionExpectation 只清空挂起的动作预期（用户取消）：行保留
+// 已收集槽位，revision +1 让任何在途的陈旧回答都作废。无行时返回
+// ErrNotFound。
+func (s *Store) ClearIntentSessionExpectation(owner, projectID, conversationID string) (IntentSession, error) {
+	if owner == "" || conversationID == "" {
+		return IntentSession{}, ErrNotFound
+	}
+	res, err := s.db.Exec(s.q(`UPDATE intent_session SET expectation=NULL, revision=revision+1, updated_at=?
+		WHERE owner=? AND project_id=? AND conversation_id=?`), nowISO(), owner, projectID, conversationID)
+	if err != nil {
+		return IntentSession{}, fmt.Errorf("clear intent session expectation: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return IntentSession{}, ErrNotFound
+	}
+	return s.GetIntentSession(owner, projectID, conversationID)
+}
+
+// scanIntentSession 组装一行会话状态；缺行一律 ErrNotFound。
+func scanIntentSession(owner, projectID, conversationID string, row *sql.Row) (IntentSession, error) {
+	var rawExpectation sql.NullString
+	var rawSlots string
+	var revision int
+	var expiresAt, createdAt, updatedAt string
+	if err := row.Scan(&rawExpectation, &rawSlots, &revision, &expiresAt, &createdAt, &updatedAt); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return IntentSession{}, ErrNotFound
+		}
+		return IntentSession{}, err
+	}
+	out := IntentSession{
+		Owner: owner, ProjectID: projectID, ConversationID: conversationID,
+		Slots: map[string]string{}, Revision: revision,
+	}
+	if rawExpectation.Valid && strings.TrimSpace(rawExpectation.String) != "" {
+		exp, err := unmarshalJSON[IntentExpectation](rawExpectation.String)
+		if err != nil {
+			return IntentSession{}, fmt.Errorf("intent session expectation: %w", err)
+		}
+		out.Expectation = &exp
+	}
+	if strings.TrimSpace(rawSlots) != "" {
+		slots, err := unmarshalJSON[map[string]string](rawSlots)
+		if err != nil {
+			return IntentSession{}, fmt.Errorf("intent session slots: %w", err)
+		}
+		if slots != nil {
+			out.Slots = slots
+		}
+	}
+	out.ExpiresAt, _ = parseTime(expiresAt)
+	out.CreatedAt, _ = parseTime(createdAt)
+	out.UpdatedAt, _ = parseTime(updatedAt)
+	return out, nil
+}

internal/store/intent_session_test.go

@@ -0,0 +1,186 @@
+package store
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+// 意图会话表（v52 / A1-U-A1b）：键含 owner+project+conversation、revision
+// 单调递增、到期时间随更新刷新；旧库（v51）是纯增量升级。
+
+func cancelExpectation() *IntentExpectation {
+	return &IntentExpectation{
+		IntentID: "demo.run-cancel", ActionKind: "command", ActionID: "demo.run-cancel",
+		Missing:  []IntentSlotQuestion{{Key: "run_id", Question: "取消哪个运行？"}},
+		Question: "取消哪个运行？",
+	}
+}
+
+func TestIntentSessionUpsertIncrementsRevisionAndRefreshesExpiry(t *testing.T) {
+	st := openTestStore(t)
+	exp := cancelExpectation()
+	first, err := st.PutIntentSession("alice", "prj_1", "cnv_1", exp, map[string]string{"run_id": "R-1"}, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Revision != 1 || first.Expectation == nil || first.Expectation.ActionID != "demo.run-cancel" {
+		t.Fatalf("首次挂起：%+v", first)
+	}
+	if first.Slots["run_id"] != "R-1" || len(first.Expectation.Missing) != 1 {
+		t.Fatalf("槽位/缺失未落库：%+v", first)
+	}
+	if !first.ExpiresAt.After(time.Now()) {
+		t.Fatalf("到期时间未设置：%+v", first)
+	}
+
+	// 同一会话再挂一次：revision +1、槽位累计、到期时间刷新。
+	second, err := st.PutIntentSession("alice", "prj_1", "cnv_1", exp,
+		map[string]string{"run_id": "R-1", "reason": "误触发"}, 2*time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if second.Revision != 2 {
+		t.Fatalf("revision 未递增：%+v", second)
+	}
+	if second.Slots["reason"] != "误触发" || second.CreatedAt != first.CreatedAt {
+		t.Fatalf("槽位累计/创建时间被改写：%+v", second)
+	}
+	if !second.ExpiresAt.After(first.ExpiresAt) {
+		t.Fatalf("到期时间未刷新：%v -> %v", first.ExpiresAt, second.ExpiresAt)
+	}
+
+	got, err := st.GetIntentSession("alice", "prj_1", "cnv_1")
+	if err != nil || got.Revision != 2 || got.Expectation.Question != "取消哪个运行？" {
+		t.Fatalf("读回：%+v %v", got, err)
+	}
+}
+
+func TestIntentSessionClearKeepsNothingAndClearExpectationKeepsSlots(t *testing.T) {
+	st := openTestStore(t)
+	exp := cancelExpectation()
+	if _, err := st.PutIntentSession("alice", "prj_1", "cnv_1", exp, map[string]string{"run_id": "R-1"}, time.Minute); err != nil {
+		t.Fatal(err)
+	}
+
+	// 取消：清空预期、保留已收集槽位、revision +1（陈旧回答就此作废）。
+	cleared, err := st.ClearIntentSessionExpectation("alice", "prj_1", "cnv_1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cleared.Expectation != nil || cleared.Revision != 2 || cleared.Slots["run_id"] != "R-1" {
+		t.Fatalf("取消后的状态：%+v", cleared)
+	}
+
+	// 动作补齐/会话结束：整行清掉（幂等）。
+	if err := st.ClearIntentSession("alice", "prj_1", "cnv_1"); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.ClearIntentSession("alice", "prj_1", "cnv_1"); err != nil {
+		t.Fatalf("重复清理必须幂等：%v", err)
+	}
+	if _, err := st.GetIntentSession("alice", "prj_1", "cnv_1"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("清理后仍可读：%v", err)
+	}
+	if _, err := st.ClearIntentSessionExpectation("alice", "prj_1", "cnv_1"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("无行时清理预期必须报 not found：%v", err)
+	}
+}
+
+// 两个用户与两个项目在构造上互不可见：别人的挂起读不到、写不进。
+func TestIntentSessionIsolatesOwnersAndProjects(t *testing.T) {
+	st := openTestStore(t)
+	exp := cancelExpectation()
+	if _, err := st.PutIntentSession("alice", "prj_1", "cnv_1", exp, map[string]string{"run_id": "R-alice"}, time.Minute); err != nil {
+		t.Fatal(err)
+	}
+	for _, probe := range []struct{ owner, project, conversation string }{
+		{"bob", "prj_1", "cnv_1"},   // 换用户
+		{"alice", "prj_2", "cnv_1"}, // 换项目
+		{"alice", "prj_1", "cnv_2"}, // 换会话
+		{"", "prj_1", "cnv_1"},      // 无归属
+	} {
+		if _, err := st.GetIntentSession(probe.owner, probe.project, probe.conversation); !errors.Is(err, ErrNotFound) {
+			t.Fatalf("%v 读到了别人的会话：%v", probe, err)
+		}
+		if err := st.ClearIntentSession(probe.owner, probe.project, probe.conversation); err != nil {
+			t.Fatalf("清理越权键：%v", err)
+		}
+	}
+	got, err := st.GetIntentSession("alice", "prj_1", "cnv_1")
+	if err != nil || got.Slots["run_id"] != "R-alice" {
+		t.Fatalf("越权清理影响了属主会话：%+v %v", got, err)
+	}
+	// 同 owner 换项目写入互不覆盖。
+	if _, err := st.PutIntentSession("alice", "prj_2", "cnv_1", exp, nil, time.Minute); err != nil {
+		t.Fatal(err)
+	}
+	if a, _ := st.GetIntentSession("alice", "prj_1", "cnv_1"); a.Slots["run_id"] != "R-alice" {
+		t.Fatalf("另一项目的写入串了会话：%+v", a)
+	}
+}
+
+// intentSessionTableExists 双档目录探测（SQLite sqlite_master / PG information_schema）。
+func intentSessionTableExists(t *testing.T, st *Store) bool {
+	t.Helper()
+	query := `SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='intent_session'`
+	if st.Dialect() == "postgres" {
+		query = `SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=current_schema() AND table_name='intent_session'`
+	}
+	var n int
+	if err := st.db.QueryRow(query).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	return n > 0
+}
+
+// 旧库（v51，无 intent_session 表）重开即升级：无数据迁移，既有行不受影响。
+func TestIntentSessionUpgradesLegacyDatabase(t *testing.T) {
+	st := openTestStore(t)
+	if err := st.MigrateDown(51); err != nil {
+		t.Fatalf("回滚到 v51：%v", err)
+	}
+	if intentSessionTableExists(t, st) {
+		t.Fatal("v51 库不应有 intent_session 表")
+	}
+	if err := st.migrate(); err != nil {
+		t.Fatalf("升级 v51 -> v52：%v", err)
+	}
+	assertFullLedger(t, st)
+	if _, err := st.PutIntentSession("alice", "prj_1", "cnv_1", cancelExpectation(), map[string]string{"run_id": "R-1"}, time.Minute); err != nil {
+		t.Fatalf("升级后写入：%v", err)
+	}
+	got, err := st.GetIntentSession("alice", "prj_1", "cnv_1")
+	if err != nil || got.Slots["run_id"] != "R-1" || got.Revision != 1 {
+		t.Fatalf("升级后读回：%+v %v", got, err)
+	}
+	// 回滚可重复演练（down 语句齐备）。
+	if err := st.MigrateDown(51); err != nil {
+		t.Fatalf("回滚 v52：%v", err)
+	}
+	if err := st.migrate(); err != nil {
+		t.Fatalf("再次升级：%v", err)
+	}
+	assertFullLedger(t, st)
+}
+
+// 空值约定：没有挂起动作时 expectation 为 NULL，已收集槽位仍是合法 JSON。
+func TestIntentSessionNullableExpectationAndEmptySlots(t *testing.T) {
+	st := openTestStore(t)
+	if _, err := st.PutIntentSession("alice", "", "cnv_1", nil, nil, 0); err != nil {
+		t.Fatal(err)
+	}
+	got, err := st.GetIntentSession("alice", "", "cnv_1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Expectation != nil || got.Slots == nil || len(got.Slots) != 0 {
+		t.Fatalf("空预期/空槽位：%+v", got)
+	}
+	if !got.ExpiresAt.IsZero() {
+		t.Fatalf("ttl<=0 时不应有过期时间：%+v", got)
+	}
+	if _, err := st.PutIntentSession("", "prj_1", "cnv_1", nil, nil, time.Minute); err == nil {
+		t.Fatal("无 owner 的写入必须被拒")
+	}
+}

internal/store/migrate.go

@@ -1225,9 +1225,38 @@ func init() {
 				"postgres": {`DROP INDEX IF EXISTS idx_users_single_super_admin`, `ALTER TABLE users DROP COLUMN is_super_admin`},
 			},
 		},
+		migration{version: 52, name: "intent_session",
+			// 意图会话（A1/U-A1b）：会话维度挂起一条可执行动作预期 + 已收集
+			// 槽位 + 单调 revision + 到期时间。纯新表，既有库是空操作（新表
+			// 增量升级，无需数据迁移）；运行态行随到期惰性清理。
+			up:   map[string][]string{"sqlite": intentSessionUp, "postgres": intentSessionUp},
+			down: map[string][]string{"sqlite": intentSessionDown, "postgres": intentSessionDown},
+		},
 	)
 }
 
+// v52 意图会话表：键含 owner+project+conversation，两个用户的会话在构造上
+// 互不可见。expectation 可空（NULL = 没有挂起动作，只剩已收集槽位），
+// slots/revision/expires_at 是折叠与陈旧回答防护的宿主状态。
+var intentSessionUp = []string{
+	`CREATE TABLE IF NOT EXISTS intent_session (
+		owner TEXT NOT NULL,
+		project_id TEXT NOT NULL DEFAULT '',
+		conversation_id TEXT NOT NULL,
+		expectation TEXT,
+		slots TEXT NOT NULL DEFAULT '{}',
+		revision INTEGER NOT NULL DEFAULT 0,
+		expires_at TEXT NOT NULL DEFAULT '',
+		created_at TEXT NOT NULL,
+		updated_at TEXT NOT NULL,
+		PRIMARY KEY (owner, project_id, conversation_id)
+	)`,
+}
+
+var intentSessionDown = []string{
+	`DROP TABLE IF EXISTS intent_session`,
+}
+
 // v35 分层 Python 环境：扩展包申请与会话绑定。层目录本身在环境根，不入库。
 var execEnvUp = []string{
 	`CREATE TABLE IF NOT EXISTS exec_env_requests (

internal/store/migrate_compat.go

@@ -58,6 +58,7 @@ var migrationBreaksOldReaders = map[int]bool{
 	49: false, // 角色权威仅新增独立表；消费者切换由公开提供者 readiness 单独围栏
 	50: false, // 角色导入 staging 为独立表；正式角色读取在激活前不变
 	51: true,  // 超级管理员标记是账号权威边界；不认识它的旧账号写者必须排除
+	52: false, // intent_session 是新表；旧制品不读取会话内的意图状态
 }
 
 // SchemaTarget 是本二进制会迁移到的 schema 版本。

internal/store/projects.go

@@ -19,17 +19,34 @@ func (s *Store) CreateProject(owner, name string) (core.Project, error) {
 	return p, err
 }
 
+// ListProjects 不含 scratch 项目：临时会话不作为普通项目出现在列表里。
 func (s *Store) ListProjects(owner string) ([]core.Project, error) {
 	rows, err := s.db.Query(s.q(`SELECT id,name,settings,created_at,updated_at FROM projects WHERE owner=? ORDER BY updated_at DESC`), owner)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
-	return scanProjects(rows)
+	all, err := scanProjects(rows)
+	if err != nil {
+		return nil, err
+	}
+	return withoutScratchProjects(all), nil
+}
+
+func withoutScratchProjects(in []core.Project) []core.Project {
+	out := make([]core.Project, 0, len(in))
+	for _, p := range in {
+		if IsScratchProject(p.Settings) {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out
 }
 
 // ListAllProjects 全量项目（含他人 owner；EXT-15）。仅供服务端在共享适配器
 // 已注册时枚举候选——调用方须逐项目过适配器，不得直接下发全表。
+// 与 ListProjects 一致，scratch 项目不进入候选。
 func (s *Store) ListAllProjects() ([]core.Project, error) {
 	rows, err := s.db.Query(s.q(`SELECT id,owner,name,settings,created_at,updated_at FROM projects ORDER BY updated_at DESC`))
 	if err != nil {
@@ -48,6 +65,9 @@ func (s *Store) ListAllProjects() ([]core.Project, error) {
 		if settings != "" && settings != "{}" {
 			p.Settings, _ = unmarshalJSON[map[string]any](settings)
 		}
+		if IsScratchProject(p.Settings) {
+			continue
+		}
 		out = append(out, p)
 	}
 	return out, rows.Err()
@@ -91,11 +111,11 @@ func (s *Store) UpdateProjectSettings(owner, id string, values map[string]any) e
 	if err != nil {
 		return err
 	}
-	cur := map[string]any{}
-	if settings != "" && settings != "{}" {
-		cur, _ = unmarshalJSON[map[string]any](settings)
-	}
+	cur := decodeProjectSettings(settings)
 	merged := core.MergeSettings(cur, values)
+	if err := rejectScratchMarkerWrite(cur, merged); err != nil {
+		return err
+	}
 	res, err := tx.Exec(s.q(`UPDATE projects SET settings=?, updated_at=? WHERE id=? AND owner=?`), marshalJSON(merged), nowISO(), id, owner)
 	if err != nil {
 		return err
@@ -215,11 +235,11 @@ func (s *Store) UpdateProjectSettingsAccountChecked(actor, id string, values map
 		if err != nil {
 			return err
 		}
-		cur := map[string]any{}
-		if settings != "" && settings != "{}" {
-			cur, _ = unmarshalJSON[map[string]any](settings)
-		}
+		cur := decodeProjectSettings(settings)
 		merged := core.MergeSettings(cur, values)
+		if err := rejectScratchMarkerWrite(cur, merged); err != nil {
+			return err
+		}
 		res, err := tx.Exec(s.q(`UPDATE projects SET settings=?,updated_at=? WHERE id=? AND owner=?`), marshalJSON(merged), nowISO(), id, actor)
 		if err != nil {
 			return err
@@ -255,15 +275,18 @@ func scanProjects(rows *sql.Rows) ([]core.Project, error) {
 // ---- 会话 ----
 
 func (s *Store) CreateConversation(owner, projectID, title, profileID string) (core.Conversation, error) {
-	// 项目归属校验：会话必须落在请求者的项目下。
-	var one int
-	err := s.db.QueryRow(s.q(`SELECT 1 FROM projects WHERE id=? AND owner=?`), projectID, owner).Scan(&one)
+	// 项目归属校验：会话必须落在请求者的项目下；scratch 项目保持 1:1。
+	var settings string
+	err := s.db.QueryRow(s.q(`SELECT settings FROM projects WHERE id=? AND owner=?`), projectID, owner).Scan(&settings)
 	if errors.Is(err, sql.ErrNoRows) {
 		return core.Conversation{}, ErrNotFound
 	}
 	if err != nil {
 		return core.Conversation{}, err
 	}
+	if err := refuseScratchConversation(settings); err != nil {
+		return core.Conversation{}, err
+	}
 	c := core.Conversation{ID: newID("cnv"), ProjectID: projectID, Owner: owner, Title: title, ProfileID: profileID, AllowCrossRead: true, CreatedAt: time.Now().UTC(), UpdatedAt: time.Now().UTC()}
 	_, err = s.db.Exec(s.q(`INSERT INTO conversations(id,project_id,owner,title,profile_id,created_at,updated_at) VALUES(?,?,?,?,?,?,?)`),
 		c.ID, c.ProjectID, owner, c.Title, c.ProfileID, nowISO(), nowISO())
@@ -273,14 +296,17 @@ func (s *Store) CreateConversation(owner, projectID, title, profileID string) (c
 // CreateConversationInProject 在共享项目下建会话（EXT-15）：只校验项目存在，
 // 不校验归属（服务端已先按自有路径尝试、再经适配器放行）；会话 owner 仍为创建者。
 func (s *Store) CreateConversationInProject(owner, projectID, title, profileID string) (core.Conversation, error) {
-	var one int
-	err := s.db.QueryRow(s.q(`SELECT 1 FROM projects WHERE id=?`), projectID).Scan(&one)
+	var settings string
+	err := s.db.QueryRow(s.q(`SELECT settings FROM projects WHERE id=?`), projectID).Scan(&settings)
 	if errors.Is(err, sql.ErrNoRows) {
 		return core.Conversation{}, ErrNotFound
 	}
 	if err != nil {
 		return core.Conversation{}, err
 	}
+	if err := refuseScratchConversation(settings); err != nil {
+		return core.Conversation{}, err
+	}
 	c := core.Conversation{ID: newID("cnv"), ProjectID: projectID, Owner: owner, Title: title, ProfileID: profileID, AllowCrossRead: true, CreatedAt: time.Now().UTC(), UpdatedAt: time.Now().UTC()}
 	_, err = s.db.Exec(s.q(`INSERT INTO conversations(id,project_id,owner,title,profile_id,created_at,updated_at) VALUES(?,?,?,?,?,?,?)`),
 		c.ID, c.ProjectID, owner, c.Title, c.ProfileID, nowISO(), nowISO())
@@ -438,8 +464,13 @@ func (s *Store) SetPermissionMode(owner, id, mode string) error {
 	return nil
 }
 
+// DeleteConversation deletes one conversation; deleting the sole conversation of
+// a scratch project also removes that scratch project, so a scratch session is
+// never left as an empty shell project.
 func (s *Store) DeleteConversation(owner, id string) error {
-	return s.updateProjectRow(owner, id, `DELETE FROM conversations WHERE id=? AND owner=?`, id, owner)
+	return s.deleteConversationCascade(s.db, owner, id, func() error {
+		return s.updateProjectRow(owner, id, `DELETE FROM conversations WHERE id=? AND owner=?`, id, owner)
+	})
 }
 
 // withOwnedConversationWrite locks the actor before the conversation and
@@ -495,10 +526,14 @@ func (s *Store) UpdateConversationAccountChecked(actor, id, title, profileID str
 	})
 }
 
-// DeleteConversationAccountChecked retains the legacy owner-only delete rule.
+// DeleteConversationAccountChecked deletes the conversation; when it was the
+// sole conversation of a scratch project, that scratch project goes with it in
+// the same write transaction, so a scratch session cannot be left half-deleted.
 func (s *Store) DeleteConversationAccountChecked(actor, id string, allowImplicitDefault bool) error {
 	return s.withOwnedConversationWrite(actor, id, allowImplicitDefault, func(tx *sql.Tx) error {
-		return s.execOwnedConversationWrite(tx, `DELETE FROM conversations WHERE id=? AND owner=?`, id, actor)
+		return s.deleteConversationCascade(tx, actor, id, func() error {
+			return s.execOwnedConversationWrite(tx, `DELETE FROM conversations WHERE id=? AND owner=?`, id, actor)
+		})
 	})
 }
 

internal/store/role_policy.go

@@ -2252,7 +2252,7 @@ func (s *Store) upsertRolePermissionsTx(tx *sql.Tx, actorID, roleID string, curr
 	for _, row := range writes {
 		if _, err := tx.Exec(s.q(`INSERT INTO role_permissions(role_id,action_id,allowed,cap_allowed,permission_version,updated_by,updated_at)
 			VALUES(?,?,?,?,?,?,?) ON CONFLICT(role_id,action_id) DO UPDATE SET allowed=excluded.allowed,cap_allowed=excluded.cap_allowed,
-				permission_version=permission_version+1,updated_by=excluded.updated_by,updated_at=excluded.updated_at`),
+				permission_version=role_permissions.permission_version+1,updated_by=excluded.updated_by,updated_at=excluded.updated_at`),
 			roleID, row.ActionID, row.Allowed, row.CapAllowed, 1, actorID, now); err != nil {
 			return err
 		}

internal/store/run_diagnostics.go

@@ -0,0 +1,110 @@
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"time"
+)
+
+// 运行诊断的只读投影（feature unit A2）。本文件只放 SELECT：不加表、不加索引、
+// 不动迁移，也不引入新的写语义。诊断面回答的是"已经落库的证据是什么"，因此
+// 每个查询都遵守同一条口径：查不到就是"没有记录"，调用方不得把它读成"没发生"
+// （与 /api/commands/operations 的对账查询同源，见 cmdbus.OperationQuery）。
+
+// RunCheckpoint 是 run 事件流上最后一个已持久化事件的稳定引用。
+//
+// 诚实边界：runs 行本身没有"检查点"列——事件流（events）才是 run 唯一的持久
+// 进度痕迹（续跑、SSE 重放都以它为准）。所以这里给的是"最后一次稳定落盘"的
+// 定位点（seq 可作游标），不是推断出来的中间状态；run 没有任何事件时不存在这条
+// 记录，调用方必须显式处理"没有"而不是编一个。
+type RunCheckpoint struct {
+	Seq  int64  // 会话事件序（可作重放游标）
+	TS   string // RFC3339（写入方原样落库）
+	Type string // 事件类型
+}
+
+// LastRunCheckpoint 返回该 run 在会话事件流里的最后一条已持久化事件。
+// 没有事件时 ok=false，err 为 nil。
+func (s *Store) LastRunCheckpoint(conversationID, runID string) (RunCheckpoint, bool, error) {
+	if conversationID == "" || runID == "" {
+		return RunCheckpoint{}, false, nil
+	}
+	var cp RunCheckpoint
+	err := s.db.QueryRow(s.q(`SELECT seq, ts, type FROM events
+		WHERE conversation_id=? AND run_id=? ORDER BY seq DESC LIMIT 1`), conversationID, runID).
+		Scan(&cp.Seq, &cp.TS, &cp.Type)
+	if errors.Is(err, sql.ErrNoRows) {
+		return RunCheckpoint{}, false, nil
+	}
+	if err != nil {
+		return RunCheckpoint{}, false, err
+	}
+	return cp, true, nil
+}
+
+// PendingHumanDecisionsByConversation 列出会话内未过期、尚未裁决的人工决策卡
+// （owner + 会话双谓词，跨租户天然不可见；过期卡按 PendingHumanDecisions 的同一
+// 口径过滤）。诊断面据此判断 run 是否在等人工裁决。
+//
+// 口径说明：决策卡按命令与会话归属，表里没有 run 列——把它归到某个 run 是调用方
+// 的时间窗推断，不是存储事实（见 rundiag 的归属边界注释）。
+func (s *Store) PendingHumanDecisionsByConversation(owner, conversationID string, now time.Time) ([]HumanDecision, error) {
+	if owner == "" || conversationID == "" {
+		return []HumanDecision{}, nil
+	}
+	rows, err := s.db.Query(s.q(`SELECT id,plugin_id,audience,command_id,human_actor,owner,project_id,proposal_id,
+		proposal_revision,payload_hash,question,status,decision,proof_id,conversation_id,issued_at,expires_at,responded_at
+		FROM human_decisions WHERE owner=? AND conversation_id=? AND status='pending' ORDER BY issued_at`),
+		owner, conversationID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []HumanDecision{}
+	for rows.Next() {
+		rec, err := scanHumanDecision(rows)
+		if err != nil {
+			return nil, err
+		}
+		if now.Before(rec.ExpiresAt) {
+			out = append(out, rec)
+		}
+	}
+	return out, rows.Err()
+}
+
+// PendingConfirm 是危险命令确认挂起态（pending_confirms）的只读行。
+// Payload 是 cmdbus 落下的分发请求 JSON（确认后据此二次分发）；诊断面只解析出
+// 归属与命令标识，不回显原始载荷。
+type PendingConfirm struct {
+	CardID    string
+	Owner     string
+	Payload   string
+	CreatedAt string
+}
+
+// ListOwnerPendingConfirms 列出该租户名下尚未确认的危险命令挂起行（时间正序）。
+// owner 为空视为无作用域：不返回任何行（纵深防御，认证层恒注入非空 owner）。
+func (s *Store) ListOwnerPendingConfirms(owner string, limit int) ([]PendingConfirm, error) {
+	if owner == "" {
+		return []PendingConfirm{}, nil
+	}
+	if limit <= 0 || limit > 200 {
+		limit = 50
+	}
+	rows, err := s.db.Query(s.q(`SELECT card_id, owner, payload, created_at FROM pending_confirms
+		WHERE owner=? ORDER BY created_at LIMIT ?`), owner, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []PendingConfirm{}
+	for rows.Next() {
+		var p PendingConfirm
+		if err := rows.Scan(&p.CardID, &p.Owner, &p.Payload, &p.CreatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, p)
+	}
+	return out, rows.Err()
+}

internal/store/run_diagnostics_test.go

@@ -0,0 +1,120 @@
+package store
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	core "agent-system-core"
+)
+
+// 运行诊断只读投影：检查点定位、HITL 决策卡的会话+租户作用域、确认挂起行的租户
+// 作用域。口径与既有读入口一致：查不到就是"没有记录"，不推断"没发生"。
+func TestRunDiagnosticsReadHelpers(t *testing.T) {
+	st := openTestStore(t)
+	base := time.Now().UTC().Truncate(time.Second)
+
+	if err := st.EnsureUser("alice", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.EnsureUser("bob", ""); err != nil {
+		t.Fatal(err)
+	}
+	project, err := st.CreateProject("alice", "诊断项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conversation, err := st.CreateConversation("alice", project.ID, "诊断会话", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run := core.Run{ConversationID: conversation.ID, ProjectID: project.ID, Owner: "alice",
+		Kind: core.RunConversation, Status: core.RunRunning, CreatedAt: base}
+	if err := st.CreateRun(&run); err != nil {
+		t.Fatal(err)
+	}
+	other := core.Run{ConversationID: conversation.ID, ProjectID: project.ID, Owner: "alice",
+		Kind: core.RunSubagent, Status: core.RunRunning, CreatedAt: base}
+	if err := st.CreateRun(&other); err != nil {
+		t.Fatal(err)
+	}
+
+	// 检查点：只认本 run 的最后一条事件，且不跨 run 串味。
+	if cp, ok, err := st.LastRunCheckpoint(string(conversation.ID), string(run.ID)); err != nil || ok {
+		t.Fatalf("a run without events has no checkpoint: %+v ok=%v err=%v", cp, ok, err)
+	}
+	if _, err := st.AppendEvents(string(conversation.ID), []core.StreamEvent{
+		{RunID: run.ID, Type: core.EvThinkingDelta, TS: base.Format(time.RFC3339), Payload: json.RawMessage(`{}`)},
+		{RunID: other.ID, Type: core.EvToolOutput, TS: base.Format(time.RFC3339), Payload: json.RawMessage(`{}`)},
+		{RunID: run.ID, Type: core.EvAgentProgress, TS: base.Format(time.RFC3339), Payload: json.RawMessage(`{}`)},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cp, ok, err := st.LastRunCheckpoint(string(conversation.ID), string(run.ID))
+	if err != nil || !ok {
+		t.Fatalf("checkpoint read: ok=%v err=%v", ok, err)
+	}
+	if cp.Type != string(core.EvAgentProgress) || cp.TS == "" || cp.Seq <= 0 {
+		t.Fatalf("checkpoint must point at the newest persisted event of this run: %+v", cp)
+	}
+	if child, ok, err := st.LastRunCheckpoint(string(conversation.ID), string(other.ID)); err != nil || !ok || child.Type != string(core.EvToolOutput) {
+		t.Fatalf("child run checkpoint: %+v ok=%v err=%v", child, ok, err)
+	}
+	if cp, ok, err := st.LastRunCheckpoint("cnv_other", string(run.ID)); err != nil || ok {
+		t.Fatalf("another conversation must not expose this run's events: %+v ok=%v err=%v", cp, ok, err)
+	}
+
+	// HITL 决策卡：pending + 未过期才可见，且按 owner+会话双谓词隔离。
+	now := base.Add(time.Minute)
+	issue := func(id, owner, conversationID string, ttl time.Duration) {
+		t.Helper()
+		if _, err := st.IssueHumanDecision(HumanDecision{PluginID: "p", Audience: "a", CommandID: "rdm.confirm",
+			HumanActor: owner, Owner: owner, ProjectID: string(project.ID), ProposalID: id, ProposalRevision: 1,
+			PayloadHash: "h" + id, Question: "approve " + id + "?", ConversationID: conversationID},
+			now.Add(-time.Minute)); err != nil {
+			t.Fatal(err)
+		}
+		// 过期口径：把 expires_at 改到过去，模拟签发即过期的卡（走方言绑定）。
+		if ttl < 0 {
+			if _, err := st.DB().Exec(st.q(`UPDATE human_decisions SET expires_at=? WHERE proposal_id=?`),
+				now.Add(-time.Hour).Format(time.RFC3339Nano), id); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	issue("alive", "alice", string(conversation.ID), time.Hour)
+	issue("expired", "alice", string(conversation.ID), -time.Hour)
+	issue("otherowner", "bob", "cnv_bob", time.Hour)
+
+	pending, err := st.PendingHumanDecisionsByConversation("alice", string(conversation.ID), now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(pending) != 1 || pending[0].ProposalID != "alive" || pending[0].Status != "pending" {
+		t.Fatalf("only live pending cards in scope: %+v", pending)
+	}
+	if cross, err := st.PendingHumanDecisionsByConversation("bob", string(conversation.ID), now); err != nil || len(cross) != 0 {
+		t.Fatalf("cross-owner cards must stay invisible: %+v err=%v", cross, err)
+	}
+	if none, err := st.PendingHumanDecisionsByConversation("", string(conversation.ID), now); err != nil || len(none) != 0 {
+		t.Fatalf("an empty owner has no scope: %+v err=%v", none, err)
+	}
+
+	// 确认挂起行：按租户隔离，空 owner 无作用域。
+	if err := st.SavePendingConfirm("card_alice", "alice", `{"ID":"rdm.confirm"}`); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.SavePendingConfirm("card_bob", "bob", `{"ID":"rdm.confirm"}`); err != nil {
+		t.Fatal(err)
+	}
+	confirms, err := st.ListOwnerPendingConfirms("alice", 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(confirms) != 1 || confirms[0].CardID != "card_alice" || confirms[0].Owner != "alice" || confirms[0].Payload == "" || confirms[0].CreatedAt == "" {
+		t.Fatalf("owner-scoped pending confirms: %+v", confirms)
+	}
+	if none, err := st.ListOwnerPendingConfirms("", 0); err != nil || len(none) != 0 {
+		t.Fatalf("an empty owner has no scope: %+v err=%v", none, err)
+	}
+}

internal/store/scratch.go

@@ -0,0 +1,230 @@
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"time"
+
+	core "agent-system-core"
+)
+
+// 临时会话（scratch session）：一个 scratch 项目 + 恰好一个私有会话。
+// scratch 属性只由项目 settings 的 host.kind 表达——它随项目行一起存储，
+// 所以判定只需要一个读函数，任何调用点都不自己比对字符串。
+
+const (
+	// ScratchHostKind 是 projects.settings.host.kind 的临时会话取值。
+	ScratchHostKind = "scratch"
+	// ScratchDefaultProjectName 是未指定名称时临时会话项目使用的默认名。
+	ScratchDefaultProjectName = "临时会话"
+)
+
+var (
+	// ErrScratchSessionSingle 会话与临时会话项目是 1:1：第二个会话被拒。
+	ErrScratchSessionSingle = errors.New("store: scratch session holds exactly one conversation")
+	// ErrScratchMarkerReserved 标记归服务端所有：客户端既不能给普通项目
+	// 加上 scratch，也不能从已有 scratch 项目上摘掉它。
+	ErrScratchMarkerReserved = errors.New("store: scratch host marker is server-owned")
+)
+
+// ScratchHostSettings 返回标记 scratch 项目的 settings 值。
+func ScratchHostSettings() map[string]any {
+	return map[string]any{"host": map[string]any{"kind": ScratchHostKind}}
+}
+
+// IsScratchProject 报告 settings 是否带 scratch 宿主标记。已存储的
+// projects.settings 与尚未合并的客户端 settings 都用它判定。
+func IsScratchProject(settings map[string]any) bool {
+	host, ok := settings["host"].(map[string]any)
+	if !ok {
+		return false
+	}
+	kind, _ := host["kind"].(string)
+	return kind == ScratchHostKind
+}
+
+// ScratchProjectIDs 返回 owner 名下带 scratch 标记的项目 id 集合：一次查询读出
+// 该 owner 的全部 projects.settings，逐行按 IsScratchProject 判定。列表响应要给
+// 一批会话打标时走它，不必逐个会话回查项目；别人的 scratch 项目不在结果里。
+func (s *Store) ScratchProjectIDs(owner string) (map[string]bool, error) {
+	rows, err := s.db.Query(s.q(`SELECT id,settings FROM projects WHERE owner=?`), owner)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]bool{}
+	for rows.Next() {
+		var id, settings string
+		if err := rows.Scan(&id, &settings); err != nil {
+			return nil, err
+		}
+		if IsScratchProject(decodeProjectSettings(settings)) {
+			out[id] = true
+		}
+	}
+	return out, rows.Err()
+}
+
+// IsScratchProjectID 是内部可信判定：按 id 读 projects.settings 的 host 标记。
+// 调用点（HTTP 门禁、回合门禁、命令分发）一律走它，不自己比对标记字符串。
+func (s *Store) IsScratchProjectID(projectID string) (bool, error) {
+	if projectID == "" {
+		return false, nil
+	}
+	p, err := s.ProjectMetadata(projectID)
+	if err != nil {
+		return false, err
+	}
+	return IsScratchProject(p.Settings), nil
+}
+
+// ScratchProjectDecision 是临时会话的归属判定，回答“这个调用是否发生在某个
+// 临时会话里”：
+//   - handled=false：不是临时会话（或项目读不到），调用点继续走原来的判定面；
+//   - handled=true, err=nil：调用者是该临时会话的属主，放行且不必再问 RDM；
+//   - handled=true, err=ErrNotFound：临时会话不是共享资源，其他人一律不可见。
+//
+// 判据只来自存储里的属主列与 host 标记，不接受调用方自称的身份。
+func (s *Store) ScratchProjectDecision(projectID, actor string) (bool, error) {
+	if projectID == "" {
+		return false, nil
+	}
+	p, err := s.ProjectMetadata(projectID)
+	if err != nil {
+		// 读不到项目（不存在或存储异常）：存在性与共享判定留给原路径，
+		// 这里不把“读不到”当成临时会话，也就不会放宽任何门禁。
+		return false, nil
+	}
+	if !IsScratchProject(p.Settings) {
+		return false, nil
+	}
+	if p.Owner != core.ID(actor) {
+		return true, ErrNotFound
+	}
+	return true, nil
+}
+
+// scratchQuerier 是本文件里临时会话判定可用的两种执行面（*sql.DB 与 *sql.Tx），
+// 于是同一个事务内的级联删除与 store 级删除共用一份语义。
+type scratchQuerier interface {
+	QueryRow(string, ...any) *sql.Row
+	Exec(string, ...any) (sql.Result, error)
+}
+
+// scratchProjectOfConversation 返回会话所属的 scratch 项目 id；普通项目返回空串。
+func (s *Store) scratchProjectOfConversation(q scratchQuerier, owner, conversationID string) (string, error) {
+	var projectID, settings string
+	err := q.QueryRow(s.q(`SELECT c.project_id, COALESCE(p.settings,'') FROM conversations c LEFT JOIN projects p ON p.id=c.project_id WHERE c.id=? AND c.owner=?`),
+		conversationID, owner).Scan(&projectID, &settings)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", ErrNotFound
+	}
+	if err != nil {
+		return "", err
+	}
+	if !IsScratchProject(decodeProjectSettings(settings)) {
+		return "", nil
+	}
+	return projectID, nil
+}
+
+// deleteScratchProjectIfEmpty 在会话已被删掉之后连带删掉它的临时会话项目：
+// 临时会话项目只承载这一个会话，删会话即删临时会话（同一个执行面、同一个门禁）。
+// 仍有会话时不动（1:1 由创建面保证，删除面不依赖该不变量做正确性）；普通项目
+// id 传进来也不会被删。
+func (s *Store) deleteScratchProjectIfEmpty(q scratchQuerier, owner, projectID string) error {
+	if projectID == "" {
+		return nil
+	}
+	var remaining int
+	if err := q.QueryRow(s.q(`SELECT COUNT(1) FROM conversations WHERE project_id=?`), projectID).Scan(&remaining); err != nil {
+		return err
+	}
+	if remaining > 0 {
+		return nil
+	}
+	res, err := q.Exec(s.q(`DELETE FROM projects WHERE id=? AND owner=?`), projectID, owner)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// deleteConversationCascade 删除一个会话，并在它是临时会话唯一会话时连带删掉
+// 临时会话项目。account-checked 路径在最终写事务内调用，legacy 路径在同一执行
+// 面上调用：语义只有一份。
+func (s *Store) deleteConversationCascade(q scratchQuerier, owner, id string, del func() error) error {
+	scratchProject, err := s.scratchProjectOfConversation(q, owner, id)
+	if err != nil {
+		return err
+	}
+	if err := del(); err != nil {
+		return err
+	}
+	return s.deleteScratchProjectIfEmpty(q, owner, scratchProject)
+}
+
+// decodeProjectSettings 把存储的 settings JSON 读成 map；缺省或损坏都是空表。
+func decodeProjectSettings(raw string) map[string]any {
+	if raw == "" || raw == "{}" {
+		return map[string]any{}
+	}
+	cur, err := unmarshalJSON[map[string]any](raw)
+	if err != nil || cur == nil {
+		return map[string]any{}
+	}
+	return cur
+}
+
+// rejectScratchMarkerWrite 拒绝改变 scratch 标记的客户端写入。保持标记不变的
+// 普通设置写入（例如给 scratch 项目改别的键）照旧通过。
+func rejectScratchMarkerWrite(current, merged map[string]any) error {
+	if IsScratchProject(current) != IsScratchProject(merged) {
+		return ErrScratchMarkerReserved
+	}
+	return nil
+}
+
+// refuseScratchConversation 按存储的 projects.settings 判定 1:1：scratch 项目
+// 下再建会话即拒，错误在会话插入之前返回。
+func refuseScratchConversation(rawSettings string) error {
+	if IsScratchProject(decodeProjectSettings(rawSettings)) {
+		return ErrScratchSessionSingle
+	}
+	return nil
+}
+
+// CreateScratchSessionAccountChecked 在一个事务里建出 scratch 项目与它唯一的
+// 会话：项目写入 host.kind 标记，会话写 cross_private=true。两者都发生在校验
+// 过的 actor 行锁之下，所以临时会话与普通项目走同一条账号有效性边界。
+// 调用方不需要（也不应）先调 CreateProjectAccountChecked——该路径不带标记，
+// 无法表示临时会话。
+func (s *Store) CreateScratchSessionAccountChecked(actor, name, title, profileID string, allowImplicitDefault bool) (core.Project, core.Conversation, error) {
+	now := time.Now().UTC()
+	project := core.Project{
+		ID: newID("prj"), Owner: core.ID(actor), Name: name,
+		CreatedAt: now, UpdatedAt: now, Settings: ScratchHostSettings(),
+	}
+	conversation := core.Conversation{
+		ID: newID("cnv"), ProjectID: project.ID, Owner: core.ID(actor), Title: title, ProfileID: profileID,
+		AllowCrossRead: true, CrossPrivate: true, CreatedAt: now, UpdatedAt: now,
+	}
+	err := s.withEffectiveAccountWrite(actor, allowImplicitDefault, func(tx *sql.Tx, _ Account) error {
+		if _, err := tx.Exec(s.q(`INSERT INTO projects(id,owner,name,settings,created_at,updated_at) VALUES(?,?,?,?,?,?)`),
+			project.ID, actor, project.Name, marshalJSON(project.Settings),
+			now.Format(time.RFC3339Nano), now.Format(time.RFC3339Nano)); err != nil {
+			return err
+		}
+		_, err := tx.Exec(s.q(`INSERT INTO conversations(id,project_id,owner,title,profile_id,cross_private,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?)`),
+			conversation.ID, conversation.ProjectID, actor, conversation.Title, conversation.ProfileID,
+			true, now.Format(time.RFC3339Nano), now.Format(time.RFC3339Nano))
+		return err
+	})
+	if err != nil {
+		return core.Project{}, core.Conversation{}, err
+	}
+	return project, conversation, nil
+}

internal/store/scratch_test.go

@@ -0,0 +1,385 @@
+package store
+
+import (
+	"errors"
+	"testing"
+)
+
+// 临时会话 store 契约（U1）：一个 scratch 项目 + 恰好一个私有会话，
+// 项目列表不出现它，会话列表仍然出现它，标记不可被客户端写入改动。
+
+func scratchAccountFixture(t *testing.T, st *Store, owner string, admin bool) {
+	t.Helper()
+	if err := st.CreateAccount(owner, owner, "", admin); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestScratchSessionCreatesOnePrivateConversationUnderScratchProject(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+
+	project, conversation, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatalf("create scratch session: %v", err)
+	}
+	if !IsScratchProject(project.Settings) {
+		t.Fatalf("project is not marked scratch: %+v", project.Settings)
+	}
+	if string(project.Owner) != "alice" || project.ID == "" {
+		t.Fatalf("unexpected project: %+v", project)
+	}
+	if string(conversation.ProjectID) != string(project.ID) || string(conversation.Owner) != "alice" {
+		t.Fatalf("conversation is not under the scratch project: %+v", conversation)
+	}
+	if !conversation.CrossPrivate || !conversation.AllowCrossRead {
+		t.Fatalf("scratch conversation must be private and cross-readable: %+v", conversation)
+	}
+	// 读回的项目行带着同一个标记，判定只有 IsScratchProject 一个来源。
+	stored, err := st.GetProject("alice", string(project.ID))
+	if err != nil || !IsScratchProject(stored.Settings) {
+		t.Fatalf("stored project marker: %+v %v", stored.Settings, err)
+	}
+}
+
+func TestScratchProjectsStayOutOfProjectListsButNotConversationLists(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+	scratchAccountFixture(t, st, "bob", false)
+
+	normal, err := st.CreateProject("alice", "普通项目")
+	if err != nil {
+		t.Fatal(err)
+	}
+	project, conversation, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// 他人的 scratch 也不进全量候选（共享适配器枚举）。
+	if _, _, err := st.CreateScratchSessionAccountChecked("bob", "临时会话", "临时会话", "", false); err != nil {
+		t.Fatal(err)
+	}
+
+	projects, err := st.ListProjects("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(projects) != 1 || projects[0].ID != normal.ID {
+		t.Fatalf("ListProjects must hide scratch projects: %+v", projects)
+	}
+	all, err := st.ListAllProjects()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != 1 || all[0].ID != normal.ID {
+		t.Fatalf("ListAllProjects must hide scratch projects: %+v", all)
+	}
+	// 侧栏任务列表仍然要能看到临时会话。
+	tasks, err := st.ListTasks("alice", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, task := range tasks {
+		if task.ID == conversation.ID {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("ListTasks dropped the scratch conversation: %+v", tasks)
+	}
+	conversations, err := st.ListConversations("alice", string(project.ID))
+	if err != nil || len(conversations) != 1 || conversations[0].ID != conversation.ID {
+		t.Fatalf("ListConversations under scratch: %+v %v", conversations, err)
+	}
+}
+
+func TestScratchProjectRefusesSecondConversationOnEveryStoreCreatePath(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+	project, _, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// account-checked 路径由服务端共用的会话创建入口（createPrivateConversation，
+	// 覆盖 POST /api/projects/{id}/conversations 与 /new）先行拒绝，见
+	// internal/server/scratch_session_test.go；这里的 store 契约覆盖本文件内
+	// 的两个创建函数。
+	for name, create := range map[string]func() error{
+		"legacy": func() error {
+			_, err := st.CreateConversation("alice", string(project.ID), "第二个", "")
+			return err
+		},
+		"shared": func() error {
+			_, err := st.CreateConversationInProject("alice", string(project.ID), "第二个", "")
+			return err
+		},
+	} {
+		if err := create(); !errors.Is(err, ErrScratchSessionSingle) {
+			t.Fatalf("%s path allowed a second conversation: %v", name, err)
+		}
+	}
+	conversations, err := st.ListConversations("alice", string(project.ID))
+	if err != nil || len(conversations) != 1 {
+		t.Fatalf("refused create still wrote a row: %+v %v", conversations, err)
+	}
+	// 普通项目不受影响。
+	normal, err := st.CreateProjectAccountChecked("alice", "普通项目", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.CreateConversationAccountChecked("alice", string(normal.ID), "正常会话", "", false, true); err != nil {
+		t.Fatalf("normal project lost conversation create: %v", err)
+	}
+}
+
+func TestScratchHostMarkerIsServerOwned(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+	scratchAccountFixture(t, st, "bob", false)
+	normal, err := st.CreateProjectAccountChecked("alice", "普通项目", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	project, _, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// 普通项目不能被加上标记（两种写入路径都不行）。
+	for name, write := range map[string]func(id string) error{
+		"legacy": func(id string) error {
+			return st.UpdateProjectSettings("alice", id, ScratchHostSettings())
+		},
+		"account-checked": func(id string) error {
+			return st.UpdateProjectSettingsAccountChecked("alice", id, ScratchHostSettings(), false)
+		},
+	} {
+		if err := write(string(normal.ID)); !errors.Is(err, ErrScratchMarkerReserved) {
+			t.Fatalf("%s path added the scratch marker: %v", name, err)
+		}
+	}
+	// scratch 项目也不能被摘掉标记。
+	cleared := map[string]any{"host": map[string]any{"kind": "normal"}}
+	if err := st.UpdateProjectSettings("alice", string(project.ID), cleared); !errors.Is(err, ErrScratchMarkerReserved) {
+		t.Fatalf("scratch marker cleared: %v", err)
+	}
+	if err := st.UpdateProjectSettingsAccountChecked("alice", string(project.ID), map[string]any{"host": nil}, false); !errors.Is(err, ErrScratchMarkerReserved) {
+		t.Fatalf("scratch marker dropped by null: %v", err)
+	}
+	// 不改变标记的普通写入照旧放行。
+	if err := st.UpdateProjectSettings("alice", string(project.ID), map[string]any{"note": "保留标记"}); err != nil {
+		t.Fatalf("unrelated settings write refused: %v", err)
+	}
+	kept, err := st.GetProject("alice", string(project.ID))
+	if err != nil || !IsScratchProject(kept.Settings) || kept.Settings["note"] != "保留标记" {
+		t.Fatalf("scratch project settings after unrelated write: %+v %v", kept.Settings, err)
+	}
+	if err := st.UpdateProjectSettings("alice", string(normal.ID), map[string]any{"note": "普通"}); err != nil {
+		t.Fatalf("normal project settings write refused: %v", err)
+	}
+}
+
+func TestScratchSessionCreateFollowsAccountState(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "admin", true)
+	scratchAccountFixture(t, st, "alice", false)
+
+	if _, _, err := st.CreateScratchSessionAccountChecked("missing", "临时会话", "临时会话", "", false); !errors.Is(err, ErrAccountForbidden) {
+		t.Fatalf("unknown actor created a scratch session: %v", err)
+	}
+	account, err := st.GetAccountByOwner("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetAccountEnabled("admin", account.ID, account.StateVersion, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false); !errors.Is(err, ErrAccountForbidden) {
+		t.Fatalf("disabled account created a scratch session: %v", err)
+	}
+	projects, err := st.ListProjects("alice")
+	if err != nil || len(projects) != 0 {
+		t.Fatalf("refused create left a project row: %+v %v", projects, err)
+	}
+}
+
+func TestScratchSessionTransactionLeavesNothingOnFailure(t *testing.T) {
+	st := openTestStore(t)
+	// 缺账号时事务回滚，项目与会话都不落库。
+	if _, _, err := st.CreateScratchSessionAccountChecked("ghost", "临时会话", "临时会话", "", false); !errors.Is(err, ErrAccountForbidden) {
+		t.Fatalf("ghost actor: %v", err)
+	}
+	all, err := st.ListAllProjects()
+	if err != nil || len(all) != 0 {
+		t.Fatalf("rolled back create left rows: %+v %v", all, err)
+	}
+}
+
+// ---- U2：隔离门禁的 store 契约 ----
+
+// IsScratchProjectID / ScratchProjectDecision 是所有门禁唯一的判定来源：
+// 属主放行，其他人 NotFound，普通项目不接管（交回原判定面）。
+func TestScratchProjectLookupAndOwnershipDecision(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+	scratchAccountFixture(t, st, "bob", false)
+	project, conversation, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	normal, err := st.CreateProjectAccountChecked("alice", "普通项目", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tc := range []struct {
+		name      string
+		projectID string
+		scratch   bool
+		err       error
+	}{
+		{"scratch", string(project.ID), true, nil},
+		{"normal", string(normal.ID), false, nil},
+		{"empty", "", false, nil},
+		{"missing", "prj_missing", false, ErrNotFound},
+	} {
+		got, err := st.IsScratchProjectID(tc.projectID)
+		if got != tc.scratch || !errors.Is(err, tc.err) {
+			t.Fatalf("%s: IsScratchProjectID = %v, %v (want %v, %v)", tc.name, got, err, tc.scratch, tc.err)
+		}
+	}
+
+	// 属主：门禁接管并放行（不查 RDM）。
+	handled, err := st.ScratchProjectDecision(string(project.ID), "alice")
+	if !handled || err != nil {
+		t.Fatalf("scratch owner decision = %v, %v", handled, err)
+	}
+	// 其他人：NotFound——临时会话不是共享资源。
+	if handled, err := st.ScratchProjectDecision(string(project.ID), "bob"); !handled || !errors.Is(err, ErrNotFound) {
+		t.Fatalf("scratch non-owner decision = %v, %v", handled, err)
+	}
+	// 普通项目与空项目 id 都不接管，原路径继续。
+	if handled, err := st.ScratchProjectDecision(string(normal.ID), "bob"); handled || err != nil {
+		t.Fatalf("normal project decision = %v, %v", handled, err)
+	}
+	if handled, err := st.ScratchProjectDecision("", "bob"); handled || err != nil {
+		t.Fatalf("empty project decision = %v, %v", handled, err)
+	}
+	// 读不到的项目不按临时会话处理（不因此放宽任何门禁）。
+	if handled, err := st.ScratchProjectDecision("prj_missing", "alice"); handled || err != nil {
+		t.Fatalf("missing project decision = %v, %v", handled, err)
+	}
+	_ = conversation
+}
+
+// ScratchProjectIDs 只报属主自己的 scratch 项目：列表响应靠它给会话打标，
+// 所以普通项目与他人临时会话都不在里面。
+func TestScratchProjectIDsCoverOnlyOwnScratchProjects(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+	scratchAccountFixture(t, st, "bob", false)
+	scratch, _, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, _, err := st.CreateScratchSessionAccountChecked("alice", "方案草稿", "方案草稿", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	normal, err := st.CreateProjectAccountChecked("alice", "普通项目", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	other, _, err := st.CreateScratchSessionAccountChecked("bob", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ids, err := st.ScratchProjectIDs("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 2 || !ids[string(scratch.ID)] || !ids[string(second.ID)] {
+		t.Fatalf("alice scratch ids = %+v", ids)
+	}
+	if ids[string(normal.ID)] {
+		t.Fatalf("normal project marked scratch: %+v", ids)
+	}
+	// 租户边界：他人的临时会话不出现在 alice 的集合里。
+	if ids[string(other.ID)] {
+		t.Fatalf("other owner's scratch project leaked: %+v", ids)
+	}
+	others, err := st.ScratchProjectIDs("bob")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(others) != 1 || !others[string(other.ID)] {
+		t.Fatalf("bob scratch ids = %+v", others)
+	}
+	// 没有项目的人拿到空集合而不是 nil 之外的东西（判空与遍历都安全）。
+	if empty, err := st.ScratchProjectIDs("carol"); err != nil || len(empty) != 0 {
+		t.Fatalf("empty scratch ids = %+v, %v", empty, err)
+	}
+}
+
+// 删掉临时会话的唯一会话即删掉它的 scratch 项目（不留空壳）；普通项目照旧。
+func TestDeletingScratchConversationDeletesScratchProject(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+	scratchAccountFixture(t, st, "bob", false)
+	project, conversation, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// 他人删除：仍然 NotFound，且临时会话原样存在。
+	if err := st.DeleteConversationAccountChecked("bob", string(conversation.ID), false); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("non-owner delete = %v", err)
+	}
+	if _, err := st.ProjectMetadata(string(project.ID)); err != nil {
+		t.Fatalf("non-owner delete removed the scratch project: %v", err)
+	}
+
+	if err := st.DeleteConversationAccountChecked("alice", string(conversation.ID), false); err != nil {
+		t.Fatalf("owner delete: %v", err)
+	}
+	if _, err := st.ProjectMetadata(string(project.ID)); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("scratch project survived its only conversation: %v", err)
+	}
+	if scratch, err := st.IsScratchProjectID(string(project.ID)); scratch || !errors.Is(err, ErrNotFound) {
+		t.Fatalf("deleted scratch project still answers as scratch: %v %v", scratch, err)
+	}
+
+	// 普通项目的会话删除不动项目。
+	normal, err := st.CreateProjectAccountChecked("alice", "普通项目", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	conv, err := st.CreateConversationAccountChecked("alice", string(normal.ID), "会话", "", false, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.DeleteConversationAccountChecked("alice", string(conv.ID), false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.ProjectMetadata(string(normal.ID)); err != nil {
+		t.Fatalf("normal project removed with its conversation: %v", err)
+	}
+}
+
+// legacy DeleteConversation 是同一条语义：删会话即删临时会话外壳。
+func TestLegacyDeleteConversationCascadesScratchProject(t *testing.T) {
+	st := openTestStore(t)
+	scratchAccountFixture(t, st, "alice", false)
+	project, conversation, err := st.CreateScratchSessionAccountChecked("alice", "临时会话", "临时会话", "", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.DeleteConversation("alice", string(conversation.ID)); err != nil {
+		t.Fatalf("legacy delete: %v", err)
+	}
+	if _, err := st.ProjectMetadata(string(project.ID)); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("legacy delete left the scratch shell: %v", err)
+	}
+}