DENIEDCURRENT EXTERNAL RED GATE
仓库 fixture 能验证顺序算法，但不能替代 production transaction root、Permit issuer、durable cursor registry、Lease activation 或 8110 listener。
0 PROD AUTH0 PROD PERMITS8110 · 0CUT 92 INPUT — CAPABILITY-FREE RE-ENTRY RECEIPT
只接受 P56 已完成三签、三 claim、preflight settlement 且 Lease activation 与 Adapter invocation 都为零的终态事实。
CUT 92 RECEIPTticket + preflight held
→ZERO EXECUTIONCUT 93 TRANSACTIONcursor + permit + seal
→FIXTURE ONLYCAPABILITY-FREE TERMINALlive authorization still held
PRODUCTION 0BOUNDARY CONTRACT — PERMIT IS NOT A BATCH CAPABILITY
Transaction Authorization 不能直接调用 Adapter；每张 Permit 只对应一个 descriptor，并且必须等前一 ordinal 的 response seal 提交完成后才允许生成。
NOT CALLABLEJUST IN TIMEDENIED22-FIELD FROZEN RESUME PLAN EXACT READBACK
Cut 91 形成、Cut 92 重新绑定的 plan 继续只读；ordinal、port、method、request digest、response schema 和预算都不能修改。
30-FIELD SEQUENTIAL RESUME TRANSACTION AUTHORIZATION
Runtime 签名绑定 Cut 92 receipt、ticket、preflight、new lease、generation、attempt、整个 frozen suffix 与 initial response-chain digest。
THREE DETACHED SEQUENTIAL RESUME AUTHORITIES
Transaction、Permit 与 Response Seal / Compensation 分属三个 owner；同一私钥或 owner 不能跨责任域复用。
team:runtime-sequential-resumeteam:security-per-call-permitteam:sre-response-sealCURSOR INITIALIZATION — START MINUS ONE
Transaction cursor 从 resumeStartOrdinal−1 开始，initial chain 绑定 Cut 92 terminal receipt；没有隐式“已完成”或跳过状态。
INITstart−1 · claimed
ORD 1permit pending
ORD 2blocked
ORD 3blocked
ORD 4blocked
ORD 5blocked
JUST-IN-TIME RULE — CURSOR + 1 OR NOTHING
只有当前 cursor 的直接后继 descriptor 可以申请 Permit；未来 ordinal、并行申请和一次签发多张全部拒绝。
COMMITTED CURSORN · chain head exact
CAS SOURCE+
EXACT NEXT DESCRIPTORN+1 · frozen tuple
ONE PERMIT=
ISSUABLE5-second / one use
NO FUTURE PERMIT32-FIELD ONE-TIME PER-CALL RETRY PERMIT
Permit 精确绑定 transaction、ticket、lease、generation、attempt、ordinal、predecessor seal、调用 tuple、schema、timeout 与剩余预算。
ONE DESCRIPTOR BINDING
一张 Permit 不能覆盖列表、范围或模板；ordinal、port、method、request digest 与 expected response schema 是不可拆分的调用身份。
| bound tuple | source | cardinality | mutation |
|---|---|---|---|
| ordinal | cursor + 1 | 1 | DENIED |
| portId + method | frozen descriptor | 1 pair | DENIED |
| requestDigest | Cut 91 plan | 1 digest | DENIED |
| response schema | frozen descriptor | 1 schema | DENIED |
TIME, BYTE & CONCURRENCY BUDGET ENVELOPE
每次调用继承 per-call timeout，同时按剩余 descriptor 数计算 remaining budget；最大并发固定为 1，任何 fan-out 都失败关闭。
≤ 5,000 ms≤ 500 msMONOTONIC ↓1 MAXFIVE-PORT FROZEN SUFFIX
不同 prior cursor 只能恢复其后缀；成功前缀不能重放，末端不能扩张，descriptor 之间不能插入额外调用。
| prior cursor | permitted suffix | permit count | prefix replay |
|---|---|---|---|
| 0 | 1 → 5 | 5 | DENIED |
| 1 | 2 → 5 | 4 | DENIED |
| 2 | 3 → 5 | 3 | DENIED |
| 3 | 4 → 5 | 2 | DENIED |
| 4 | 5 | 1 | DENIED |
PERMIT NONCE — CLAIM ONCE, BURN ON AMBIGUITY
Permit nonce 必须在调用前原子 claim；重放、未知 claim 结果或调用结果不确定都会烧毁 Permit 并停止整个 transaction。
AVAILABLEnot callable yet
→
CLAIMEDone ordinal only
→
SEALED / BURNEDno second use
ISOLATED FIXTURE INVOCATION ENVELOPE
仓库验证端口只接收 Permit 与 descriptor 的纯数据 digest；不接收 callable、连接、密钥、旧 response payload 或 production Adapter handle。
DIGEST ONLYNOT PRODUCTIONNO PAYLOAD0RESPONSE VALIDATION BEFORE RE-SEAL
ordinal、request digest、response class、response digest 与 expected schema 全部成立后才允许产生 response seal；schema mismatch 直接停止。
MATCHMATCHVALIDMATCHNONE26-FIELD RETRY RESPONSE SEAL
SRE seal 绑定 Permit digest、ordinal、调用 tuple、response digest、schema、predecessor 与 chain digest，并明确 payload 与引用均未保留。
HASH-CHAINED RESPONSE RE-SEAL
每个 seal 的 chainDigest 同时吸收 predecessor、Permit digest、response digest、schema 与 ordinal，成为下一张 Permit 的唯一 chain head。
PREDECESSORCut 92 receipt or seal N
CHAIN HEAD+
PERMIT + RESPONSEscope + digest + schema
CANONICAL SHA-256=
SEAL N+1next predecessor
IMMUTABLEATOMIC RESPONSE SEAL COMMIT
sealId、permitId、ordinal、expected cursor 与 chain digest 作为一个不可拆分提交；duplicate commit 或 ambiguous commit 都停止。
REQUIREDATOMICDENIEDCURSOR COMPARE-AND-SET — EXACTLY ONE
只有已提交 seal 的 ordinal 能把 cursor 从 N 推进到 N+1；跳级、回退、重复 advance 或 activeCalls≠0 全部拒绝。
CURSOR Ncommitted
SEAL N+1atomic commit
CASN → N+1
N+2still blocked
PARALLELdenied
SKIPdenied
STRICT SEQUENTIAL LOOP
Permit、fixture result、seal commit 与 cursor advance 四步必须逐 descriptor 闭环；前一步没有 terminal receipt，下一步不存在。
01 · SELECTcursor+1
02 · ISSUEone permit
03 · CLAIMnonce once
04 · FIXTUREdigest envelope
05 · VALIDATEschema exact
06 · SEALpayload gone
07 · COMMITCAS source
08 · ADVANCEexactly one
09 · REPEATor settle
NO PREFIX REPLAY, NO FUTURE PREISSUE
成功前缀、已完成 ordinal 与未来 ordinal 同时位于 Permit 边界之外；transaction 不是批量 Permit 模板。
LOCKEDONLY ISSUABLENOT YET0FAILURE STOP BOUNDARY
任何 post-claim 模糊性都不会猜测成功、重试当前调用或继续后续 ordinal；transaction 立即进入 stop / revoke。
BEFORE FAILURE
- cursor N committed
- current permit optional
- future permits = 0
STOP / REVOKEno retry inside retry
- burn current permit
- do not advance cursor
- block all later descriptors
TERMINAL PROOF
- active calls = 0
- payload retained = 0
- production effects = 0
23-FIELD STOP / REVOKE COMPENSATION RECEIPT
Compensation 明确记录 failed ordinal、last committed cursor、当前 Permit burn、futurePermitCount=0、无失败后 cursor advance 和零生产副作用。
18 FAILURE CUTPOINTS
从 Cut 92 receipt 到 compensation settlement 的每一个边界都可注入故障，且 terminal truth 保持 future permits 0、active calls 0、production calls 0。
24 QUALIFIED SEQUENTIAL RESUME TRANSACTIONS
五种 cursor suffix 全覆盖；合法 fixture path 逐 ordinal 签发 Permit、验证响应、提交 seal、推进 cursor，最终仍只形成 live-held terminal receipt。
24 CUT 92 RECEIPTScapability free
→70 HAPPY-PATH PERMITScursor suffix 1..5
→24 TERMINAL RECEIPTSproduction calls 0
276 REJECTED OR STOPPED TRANSACTIONS
六个拒绝面分别覆盖 upstream、transaction auth、Permit、response seal、cursor CAS 与 failure compensation。
300-CASE EXECUTABLE QA LAB
按 suite 筛选、搜索并点击用例，核对 Permit、Seal、Cursor、Compensation 与所有生产零副作用字段。
Select a QA case
300 / 300 passed · futurePermitsPreissued=0 · parallelInvocations=0 · cursorSkips=0 · retainedResponsePayloads=0 · productionPerCallRetryPermits=0 · productionAdapterInvocations=0P57A–H SUBGATES
八个仓库子门全部闭环；真实 transaction、Permit、seal roots、durable cursor registry、Lease activation 和 Controller listener 继续独立红门。
123 / 133 QUALITY GATES & VISIBLE DEBT
十个 live 门未观测；repository、isolated fixture 与 production evidence 继续作为三个不可混淆的事实层。
CUT 94 / 104 · 11 CUTS REMAIN
14 LIVE DEBTS · CUT 94 HANDOFF — lease activation receipt & signed invocation envelope dry-run
下一刀承接 Cut 93 capability-free sequential terminal receipt，定义短期 Lease Activation Receipt、逐调用 signed invocation envelope、production-like isolated dry-run 与激活撤销边界。Cut 93 的 fixture Permit 不能进入 production Adapter。
01 · LEASE ACTIVATIONshort-lived signed receipt
02 · INVOCATION ENVELOPEpermit + request identity
03 · DRY-RUN ADAPTERproduction-like / zero effect
04 · REVOCATIONactivation burn and settle
| owner | missing production fact | status |
|---|
| surface | canonical path | use |
|---|---|---|
| Machine API | /api/runner-controller/d05-g04-per-call-retry-permit-sequential-resume-transaction-admission | runtime evidence |
| JSON Schema | /schemas/runner-controller-d05-g04-per-call-retry-permit-sequential-resume-transaction-admission.v1.schema.json | consumer validation |
| Candidate | ops/runner-factory/controller-production-adapter-per-call-retry-permit-sequential-resume-transaction-candidate.mjs | qualification logic |
| Verifier | scripts/verify-runner-controller-production-adapter-per-call-retry-permit-sequential-resume-transaction-candidate.mjs | 300 cases |
| Architecture doc | docs/ui-blueprint/186-d05-g04-per-call-retry-permit-sequential-resume-transaction-admission.md | team handoff |