fix(mcp): применять права к прямым переходам и проверять маршрутизацию

backend/src/modules/mcp/routing-community-scoped-acceptance.ts

@@ -188,7 +188,7 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
     }
     await pool.query("INSERT INTO filter_rules(server_id,sort_order,community,community_name,action,gateway,gateway_tunnel_id,description) VALUES($1,77,'65000:10','NEVER_SCOPED_SQL_NAME','route','203.0.113.99','NEVER_SCOPED_SQL_TUNNEL','NEVER_SCOPED_SQL_DESCRIPTION')", [sid])
     const dbBefore = (await pool.query("SELECT * FROM filter_rules WHERE server_id=$1 ORDER BY id", [sid])).rows
-    const prepare = async (key = "a", persistent?: { id: string; version: number }, exactProfile?: ReturnType<typeof profile>) => {
+    const prepare = async (key = "a", persistent?: { id: string; version: number }, exactProfile?: ReturnType<typeof profile>, assertApprovalRequired = false) => {
       const current = exactProfile === undefined ? profile(key) : routeAiProfileSchema.parse(exactProfile)
       assert.equal((await invokeMcpTool(principal, "mm_route_path_verify", { profile: current, candidateId: "b" }) as { status: string }).status, "passed")
       const plan = await invokeMcpTool(principal, "mm_route_optimizer_plan", { profile: current, candidateId: "b" }, undefined,
@@ -204,6 +204,11 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
         assert(!JSON.stringify(projection).includes("persistentProfileAuthority"), "Persistent authority remains private")
       }
       assert.equal(evidence.requiresHuman, true); assert.equal(evidence.mutationCost, 2); assert.ok(!JSON.stringify(input).includes("NEVER_")); assert.equal(input.compiledBody, undefined)
+      if (assertApprovalRequired) {
+        const beforeApproval = { writes, requests }
+        await assert.rejects(applyPlan(principal, plan.planId, randomUUID()), (error: unknown) => error instanceof McpError && error.code === "APPROVAL_REQUIRED")
+        assert.deepEqual({ writes, requests }, beforeApproval)
+      }
       await approvePlan(plan.planId, writer, true); return { plan, input }
     }
     const execute = async (planId: string, executingPrincipal: McpPrincipal = principal) => {
@@ -238,21 +243,28 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
     const disablePersistent = (id: string) => pool.query("UPDATE mcp_routing_profiles SET enabled=false WHERE id=$1", [id])
     if (options.originalEffectsOnly) {
       const cases: Array<Record<string, unknown>> = []
-      for (const effectCase of ["transition", "no-op", "ambiguous"] as const) {
+      let publicManualRevision2: Record<string, unknown> | undefined
+      for (const scenario of ["transition", "no-op", "ambiguous", "public-manual-rev2"] as const) {
+        const manual = scenario === "public-manual-rev2"
+        const effectCase = manual ? "transition" : scenario
         reset(); await refresh(); originalEffectCase = effectCase
         const config = profile("a")
         for (const candidate of config.candidates) candidate.controlProbe!.sourceAddress = "198.51.100.1"
         assert.equal(config.autoRecovery, false)
         // The baseline and persistent authority are issued by the SAME actual
         // fixed readers/CAS used by existing tests, not hand-written proofs.
-        const persistent = await persistentFixture(config)
+        const persistent = manual ? undefined : await persistentFixture(config)
         try {
-          const { plan, input } = await prepare("a", persistent, config)
+          const { plan, input } = await prepare("a", persistent, config, manual)
+          assert.equal(input.manualEffectPolicy, manual ? "observational-v1" : undefined)
+          if (manual) assert.equal(input.persistentProfileAuthority, undefined)
           const sealedSelection = originalEffectSelectionSchema.parse(input.originalEffectSelection)
           assert.equal(sealedSelection.status, effectCase === "ambiguous" ? "unknown" : "prepared")
           const storedPlan = await loadPlan(plan.planId)
           assert.equal(storedPlan.approved_by, writer.id)
-          assert(!JSON.stringify(await publicPlan(storedPlan)).includes("originalEffectSelection"))
+          const publicProjection = JSON.stringify(await publicPlan(storedPlan))
+          assert(!publicProjection.includes("originalEffectSelection"))
+          assert(!publicProjection.includes("manualEffectPolicy"))
           const beforeWrites = writes, wireStart = originalEffectWire.length
           const operation = await execute(plan.planId)
           assert.equal(operation.state, "applied", "Optional effect unknown must preserve genuine manual configuration/probe acceptance")
@@ -266,15 +278,19 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
           assert.equal(rows[0].result.configurationVerified, true); assert.equal(rows[0].result.controlProbeVerified, true)
           const report = originalEffectReportSchema.parse(rows[0].result.originalEffects)
           const requestSeal = await assertScopedCommunityRequest(input)
+          if (manual) {
+            const changedInput = { ...input, manualEffectPolicy: "unapproved-policy" }
+            await assert.rejects(assertScopedCommunityRequest(changedInput), (error: unknown) => error instanceof McpError && error.code === "STATE_CONFLICT")
+          }
           const configuration = await loadScopedConfigurationPacket(input, requestSeal, { operationId: operation.id, stepIndex: 0 })
           assert(configuration); assert.equal(configuration.packet.operationId, operation.id)
-          assert.equal(configuration.packet.revision, 2); assert.equal(configuration.packet.phase, "CONFIG_APPLIED")
+          assert.equal(configuration.packet.revision, manual ? 1 : 2); assert.equal(configuration.packet.phase, "CONFIG_APPLIED")
           const network = await loadScopedNetworkCheckpoint(input, requestSeal)
           assert(network); assert.equal(network.status, "passed"); assert.deepEqual(network.originalEffects, report)
           const runningWire = originalEffectWire.slice(wireStart)
           const ribBefore = runningWire.filter(row => row.method === "GET" && row.path === "/routing/route" && !row.afterPatch).length
           const ribAfter = runningWire.filter(row => row.method === "GET" && row.path === "/routing/route" && row.afterPatch).length
-          console.log("Owned original effect diagnostic:", JSON.stringify({ case: effectCase, state: operation.state,
+          console.log("Owned original effect diagnostic:", JSON.stringify({ case: scenario, state: operation.state,
             status: report.status, reason: report.reason, rounds: report.rounds.length, budget: report.budget ?? null,
             ribBefore, ribAfter, runtimeNativeRequests: runningWire.length, lastNativePaths: runningWire.slice(-8).map(row => row.path) }))
           assert.equal(ribBefore, effectCase === "ambiguous" ? 0 : 1)
@@ -293,6 +309,22 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
             assert.deepEqual(report.transition?.changedPrefixes, effectCase === "transition" ? ["203.0.113.0/24"] : [])
             assert.equal(report.transitionAttribution, "unproven")
           }
+          if (manual) {
+            const repeatReads = requests
+            const repeated = await applyPlan(principal, plan.planId, randomUUID())
+            assert.equal(repeated.id, operation.id)
+            assert.equal(repeated.state, "applied")
+            assert.equal(requests, repeatReads)
+            assert.equal(writes - beforeWrites, 1)
+            assert.equal(Number((await pool.query("SELECT count(*) AS n FROM mcp_routing_profiles WHERE enabled")).rows[0].n), 0)
+            assert.equal(Number((await pool.query("SELECT count(*) AS n FROM mcp_scoped_recovery_intents WHERE source_operation_id=$1", [operation.id])).rows[0].n), 0)
+            publicManualRevision2 = { accepted: true, humanApprovalRequired: true, proofRevision: input.proofRevision,
+              configurationCheckpointRevision: configuration.packet.revision, effectStatus: report.status,
+              rounds: report.rounds.length, nativeRibBefore: ribBefore, nativeRibAfter: ribAfter, sharedBudget: report.budget,
+              autoRecoveryAllowed: report.autoRecoveryAllowed, scopedControllerEnabled: false, nativeWrites: 1 }
+            continue
+          }
+          assert(persistent)
           const row = (await pool.query("SELECT state,grant_expires_at FROM mcp_routing_profiles WHERE id=$1 AND version=1", [persistent.id])).rows[0]
           assert(row?.state.baseline)
           const advance = () => advanceRoutingControllerBaseline(row.state.baseline, persistent.id, 1, config, row.grant_expires_at.toISOString(),
@@ -332,10 +364,11 @@ export async function acceptScopedRouteCommunitySwitch(actor: AuthUser, options:
             effectStatus: report.status, observedFibTransition: report.switchEffectObserved, nativeRibBefore: ribBefore, nativeRibAfter: ribAfter,
             sharedBudget: report.budget ?? null, effectBaselineAdvanceAccepted: effectCase === "transition", effectGateNativeReads: effectCase === "transition" ? "fresh-native-checked" : 0,
             actualTickPausedByExistingScopedGuard: true, tickEffectPauseAccepted: false, publicManualRevision2EffectOwnerAccepted: false })
-        } finally { await disablePersistent(persistent.id) }
+        } finally { if (persistent) await disablePersistent(persistent.id) }
       }
+      assert(publicManualRevision2)
       assert.deepEqual((await pool.query("SELECT * FROM filter_rules WHERE server_id=$1 ORDER BY id", [sid])).rows, dbBefore)
-      const result = { accepted: true, cases, persistentAuthorityCases: 0, realMcpDispatcher: true, realSql: true, routerOsTransport: "declared-synthetic-localhost-http",
+      const result = { accepted: true, cases, publicManualRevision2, persistentAuthorityCases: 0, realMcpDispatcher: true, realSql: true, routerOsTransport: "declared-synthetic-localhost-http",
         genuineApprovedRunningOrigin: true, actualConfigurationCheckpoint: true, signedEffectTamperRejected: true,
         originalAutoRecoveryEnabled: false, fullRoutingAccepted: false, scopedControllerEnabled: false, nativeChrAccepted: false, forwardingVerified: false }
       console.log("Original effect SQL/runtime component:", JSON.stringify(result))

backend/src/modules/mcp/routing-community-scoped-service.ts

@@ -138,7 +138,9 @@ export async function prepareScopedCommunitySwitch(input: Record<string, unknown
     catch (error) { if (!(error instanceof McpError) || error.code !== "APPROVAL_REQUIRED") throw error }
   }
   const originalEffectSelection = await value.context.captureOriginalEffectSelection(String(input.candidateId))
-  const sealed: Record<string, unknown> = { ...withPath, originalEffectSelection, nativeId: owned.nativeId, outIface, contextSources: value.context.before.sourceProofs, dependencyProof: value.context.before.dependencyProof,
+  const sealed: Record<string, unknown> = { ...withPath, originalEffectSelection,
+    ...(!persistent && !profile.autoRecovery && originalEffectSelection.status === "prepared" ? { manualEffectPolicy: "observational-v1" } : {}),
+    nativeId: owned.nativeId, outIface, contextSources: value.context.before.sourceProofs, dependencyProof: value.context.before.dependencyProof,
     originalTargetProof: value.context.before.targetRuleProof, desiredTargetProof: owned.desiredTargetProof(compiled.compiledBody), receiptId: randomUUID(), proofRevision: persistent ? 3 : 2,
     originalCandidateId: value.context.before.currentCandidateId, originalRuleCiphertext: await encryptSecret(String(owned.rawRow.rule)), desiredRuleCiphertext: await encryptSecret(compiled.compiledBody), managementBindingCiphertext,
     rules: [publicRule(compiled.proposed)], beforeRules: [publicRule(compiled.before)] }
@@ -174,7 +176,7 @@ export function registerScopedCommunityService() {
       try {
         // Optional original-effect vector is never an extra write/recovery grant.
         // Old manual configuration+probe acceptance remains authoritative.
-        if (context?.phase === "forward" && input.proofRevision === 3 && effectSelection.success && effectSelection.data.status === "prepared") {
+        if (context?.phase === "forward" && (input.proofRevision === 3 || input.proofRevision === 2 && input.manualEffectPolicy === "observational-v1") && effectSelection.success && effectSelection.data.status === "prepared") {
           try {
             const selected = effectSelection.data
             effectSession = await createRoutingNetworkSessionForCurrentExecution({ servers: scopedProfileIds(before.profile),

backend/src/modules/mcp/routing-network-configuration-bridge.test.ts

@@ -14,7 +14,7 @@ async function fixture() {
   let nativeReads = 0, profileChecks = 0, sourceReads = 0, configChecks = 0
   let nativeBody = "desired", nativeDependency = "dependency", nativeTarget = "desired-target", nativeCandidate = "b", nativeId = "*1", generation = "generation"
   let afterNative: (() => void) | undefined, afterCheckpoint: (() => void) | undefined, afterProfile: (() => void) | undefined
-  let sharedReads = 0, sharedClosed = false
+  let sharedReads = 0, sharedClosed = false, manualOwner = false
   class ClockDate extends Date { static now() { return now } }
   class BridgeError extends Error { constructor(readonly code: string, message: string) { super(message) } }
   const fingerprint = (value: unknown) => JSON.stringify(value)
@@ -37,6 +37,7 @@ async function fixture() {
   const sharedToken = Object.freeze({}), acquisition = Object.freeze({}), sharedBinding = { sourceOperationId: row.id, profile: structuredClone(profile), principal: structuredClone(principal),
     deadline: now + 10000, contextSources: structuredClone(input.contextSources), candidateId: "b" }
   const providers: Record<string, unknown> = {
+    "./routing-network-execution-session.js": { isVerifiedManualEffectOwner: (owner: unknown) => owner === sharedToken && manualOwner },
     zod: { z }, "@mmapp/contracts/mcp-routing": { routeAiProfileSchema: { parse: (value: unknown) => value } },
     "../../db/index.js": { pool: { query: async () => { sourceReads++; return { rows: [{ ...row, plan_id: sourceChanged ? "changed" : row.plan_id }] } } } },
     "../../lib/permissions.js": { hasPermission: (values: string[], permission: string) => values.includes(permission) },
@@ -93,7 +94,7 @@ async function fixture() {
   const reseal = () => { row.evidence.sealed = JSON.stringify(evidence) }
   return { resolve: () => resolve(row.id, action), resolveShared: (token = sharedToken) => resolveShared(token, action), sharedToken, sharedBinding,
     consume, close, resolveRound: () => resolveRound(sharedToken, action), readRound: (token: object, read = acquisition) => readRound(token, read), closeRound, acquisition,
-    row, input, profile, checkpoint, packet, action, authority, reseal,
+    row, input, profile, checkpoint, packet, action, authority, reseal, brandManual: () => { manualOwner = true },
     stats: () => ({ nativeReads, profileChecks, sourceReads, configChecks, sharedReads, sharedClosed }), advance: (ms: number) => { now += ms },
     revoke: () => { revoked = true }, sourceChanged: () => { sourceChanged = true }, checkpointMissing: () => { checkpointMissing = true },
     checkpointChanged: () => { checkpointChanged = true }, guard: () => { guard = true },
@@ -110,6 +111,25 @@ test("fixed resolver captures opaque context and consume rechecks configuration
   assert.equal(f.stats().nativeReads, 2); assert(f.stats().profileChecks > 5)
   await assert.rejects(f.consume(token), /Unknown or consumed/); await assert.rejects(f.resolve(), /already issued/)
 })
+
+for (const mode of ["positive", "unbranded", "wrong-checkpoint", "terminal-source", "standalone"] as const) {
+  test(`manual revision-2 round ${mode}`, async () => {
+    const f = await fixture()
+    f.input.proofRevision = 2; f.input.manualEffectPolicy = "observational-v1"; delete f.input.persistentProfileAuthority
+    f.row.state = mode === "terminal-source" ? "applied" : "running"; f.row.step_state = "intent"
+    f.packet.revision = mode === "wrong-checkpoint" ? 2 : 1
+    if (mode !== "unbranded") f.brandManual()
+    f.reseal()
+    if (mode !== "positive") {
+      await assert.rejects(mode === "standalone" ? f.resolve() : f.resolveRound())
+      assert.equal(f.stats().nativeReads, 0)
+      return
+    }
+    const round = await f.resolveRound(), observation = await f.readRound(round)
+    assert.equal(observation.sharedNetworkBudgetVerified, true)
+    assert.equal(observation.forwardingVerified, false)
+  })
+}
 test("caller objects, JSON, another resolver and closed contexts cannot be consumed", async () => {
   const f = await fixture(), other = await fixture(), token = await f.resolve()
   await assert.rejects(f.consume({}), /Unknown or consumed/); await assert.rejects(f.consume(JSON.parse(JSON.stringify(token))), /Unknown or consumed/)

backend/src/modules/mcp/routing-network-configuration-bridge.ts

@@ -8,6 +8,7 @@ import { findMcpOperation } from "./registry.js"
 import { accessGeneration, decryptSecret, fingerprint, McpError, redact } from "./security.js"
 import { assertScopedCommunityRequest } from "./routing-community-scoped-request.js"
 import { loadScopedConfigurationPacket } from "./routing-community-scoped-checkpoint.js"
+import { isVerifiedManualEffectOwner } from "./routing-network-execution-session.js"
 import { assertPersistentScopedProfileAuthority, routingProfileAuthorityBindingSchema } from "./routing-profile-authority.js"
 import { readRouteCommunityContext, readRouteCommunityContextWithSharedNativeSession } from "./routing-community-context.js"
 import { readRoutingNetworkScopedCommunityContext } from "./routing-network-scoped-context.js"
@@ -137,9 +138,16 @@ async function resolveConfigurationContext(sourceOperationId: string, action: Ac
       if (binding.sourceOperationId !== sourceOperationId || fingerprint(binding.profile) !== fingerprint(profile) ||
         fingerprint(binding.contextSources) !== fingerprint(input.contextSources) || binding.candidateId !== input.candidateId) throw fail("Shared configuration source binding changed")
     }
-    if (input.proofRevision !== 3 || input.persistentProfileAuthority === undefined || profile.autoRecovery) throw fail("Persistent manual revision-3 source required; recovery guard remains closed")
-    const authority = routingProfileAuthorityBindingSchema.parse(input.persistentProfileAuthority)
-    deadline = Math.min(deadline, Date.parse(authority.packet.validUntil))
+    const manual = !!sharedContext && deferredRoundReadback && isVerifiedManualEffectOwner(sharedContext)
+    if (profile.autoRecovery) throw fail("Recovery guard remains closed")
+    if (manual) {
+      if (row.state !== "running" || row.step_state !== "intent" || input.proofRevision !== 2 ||
+        input.persistentProfileAuthority !== undefined || input.manualEffectPolicy !== "observational-v1") throw fail("Exact running manual effect source required")
+    } else {
+      if (input.proofRevision !== 3 || input.persistentProfileAuthority === undefined) throw fail("Persistent manual revision-3 source required")
+      const authority = routingProfileAuthorityBindingSchema.parse(input.persistentProfileAuthority)
+      deadline = Math.min(deadline, Date.parse(authority.packet.validUntil))
+    }
     signal = AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, deadline - Date.now()))])
     active()
     const ids = [...new Set([profile.serverId, ...profile.candidates.flatMap(candidate => [candidate.jumpHostId, candidate.exitNodeId])])].sort((a,b) => a-b)
@@ -160,7 +168,7 @@ async function resolveConfigurationContext(sourceOperationId: string, action: Ac
     const checkpoint = async () => {
       await authorize()
       const result = await guarded(() => loadScopedConfigurationPacket(input, requestSeal, { operationId: sourceOperationId, stepIndex: 0 }))
-      if (!result || result.packet.revision !== 2 || result.packet.operationId !== sourceOperationId || result.packet.stepIndex !== 0 ||
+      if (!result || result.packet.revision !== (manual ? 1 : 2) || result.packet.operationId !== sourceOperationId || result.packet.stepIndex !== 0 ||
         result.packet.phase !== "CONFIG_APPLIED" || Date.parse(result.observedAt) < row.created_at.getTime() || Date.parse(result.observedAt) > Date.now() ||
         Date.parse(result.observedAt) >= deadline) throw fail("Genuine persistent CONFIG_APPLIED unavailable")
       await authorize()

backend/src/modules/mcp/routing-network-execution-origin.test.mjs

@@ -21,7 +21,7 @@ function fixture() {
   const lifetime = { expiresAt: now + 60000, monotonicDeadline: performance.now() + 60000, signal: new AbortController().signal };
   let calls = 0, inspections = 0, closed = 0, options, query, originAvailable = true, afterCreate = () => {};
   const connection = { owner_valid_until: new Date(now + 110000), policy: { expiresAt: new Date(now + 120000).toISOString() } };
-  const token = Object.freeze({});
+  const token = Object.freeze({}), sharedContext = Object.freeze({});
   const providers = {
     'node:crypto': { createHash },
     '../../db/index.js': { pool: { query: async value => { query = value; return { rows: [row] }; } } },
@@ -34,15 +34,35 @@ function fixture() {
     './registry.js': { findMcpOperation: () => ({ version: 7 }) },
     './security.js': { fingerprint: JSON.stringify, redact: value => value, McpError: Error },
     './routing-profile-authority.js': { routingProfileAuthorityBindingSchema: { parse: value => value } },
-    './routing-network-native-session.js': { createRoutingNetworkNativeSession: async value => { calls++; options = value; afterCreate(); return { close() { closed++; } }; } }
+    './routing-network-native-session.js': { createRoutingNetworkNativeSession: async value => { calls++; options = value; afterCreate(); return { sharedContext, close() { closed++; } }; } }
   };
   const exports = {};
   new Function('exports', 'require', code)(exports, name => { assert.ok(providers[name], name); return providers[name]; });
   const manifest = { servers: [1, 2], probes: [] };
-  return { metadata, row, lifetime, connection, manifest, now, run: () => exports.createRoutingNetworkSessionForCurrentExecution(manifest),
+  return { metadata, row, lifetime, connection, manifest, now, sharedContext, isManual: exports.isVerifiedManualEffectOwner, run: () => exports.createRoutingNetworkSessionForCurrentExecution(manifest),
     revokeOrigin: () => { originAvailable = false; }, afterCreate: fn => { afterCreate = fn; },
     stats: () => ({ calls, closed, inspections, options, query }) };
 }
+for (const mode of ['positive', 'missing-policy', 'missing-selection', 'recovery', 'late-revocation']) {
+  test(`manual effect owner origin ${mode}`, async () => {
+    const f = fixture();
+    f.metadata.serviceInput = { proofRevision: 2, manualEffectPolicy: 'observational-v1', profile: { autoRecovery: mode === 'recovery' }, originalEffectSelection: { status: 'prepared' } };
+    if (mode === 'missing-policy') delete f.metadata.serviceInput.manualEffectPolicy;
+    if (mode === 'missing-selection') delete f.metadata.serviceInput.originalEffectSelection;
+    if (mode === 'late-revocation') f.afterCreate(() => { f.metadata.approved = false; });
+    f.row.intended_state.input = structuredClone(f.metadata.serviceInput);
+    if (mode === 'positive') {
+      await f.run();
+      assert.equal(f.isManual(f.sharedContext), true);
+      assert.equal(f.isManual(JSON.parse(JSON.stringify(f.sharedContext))), false);
+    } else {
+      await assert.rejects(f.run());
+      assert.equal(f.isManual(f.sharedContext), false);
+      assert.equal(f.stats().calls, mode === 'late-revocation' ? 1 : 0);
+      assert.equal(f.stats().closed, mode === 'late-revocation' ? 1 : 0);
+    }
+  });
+}
 test('real origin supplies operation, principal, signal and minimum immutable horizon', async () => {
   const f = fixture(); await f.run(); const { options, query } = f.stats();
   assert.equal(options.sourceOperationId, f.metadata.operationId); assert.equal(options.context.signal, f.lifetime.signal);

backend/src/modules/mcp/routing-network-execution-session.ts

@@ -6,7 +6,14 @@ import { effectiveMcpConnection } from "./store.js"
 import { findMcpOperation } from "./registry.js"
 import { fingerprint, McpError, redact } from "./security.js"
 import { routingProfileAuthorityBindingSchema } from "./routing-profile-authority.js"
-import { createRoutingNetworkNativeSession, type RoutingNetworkNativeManifest } from "./routing-network-native-session.js"
+import { createRoutingNetworkNativeSession, type RoutingNetworkNativeManifest, type RoutingNetworkSharedContext } from "./routing-network-native-session.js"
+
+const manualEffectOwners = new WeakSet<RoutingNetworkSharedContext>()
+
+/** Only the verified execution factory can mark a genuine shared owner. */
+export function isVerifiedManualEffectOwner(owner: RoutingNetworkSharedContext): boolean {
+  return manualEffectOwners.has(owner)
+}
 
 /** Private producer for the existing native/configuration-round reader. The
  * manifest selects reads, never identity or authority. Its exact scope, probe
@@ -21,6 +28,10 @@ export async function createRoutingNetworkSessionForCurrentExecution(manifest: R
   if (!initial.approved || initial.phase !== "forward" || initial.stepIndex !== 0 ||
     initial.operationName !== "routing.community.switch" || initial.operationVersion !== findMcpOperation(initial.operationName)?.version ||
     initial.serviceName !== "routing.community.scoped") throw fail()
+  const input = initial.serviceInput, manual = input.proofRevision === 2
+  if (manual && (input.manualEffectPolicy !== "observational-v1" || input.persistentProfileAuthority !== undefined ||
+    (input.profile as { autoRecovery?: unknown } | undefined)?.autoRecovery !== false ||
+    (input.originalEffectSelection as { status?: unknown } | undefined)?.status !== "prepared")) throw fail()
   const lifetime = await inspectVerifiedMcpServiceExecutionLifetime(origin)
   const authorize = async () => {
     const current = await inspectVerifiedMcpServiceExecution(origin)
@@ -57,6 +68,10 @@ export async function createRoutingNetworkSessionForCurrentExecution(manifest: R
   if (!Number.isFinite(readDeadline) || Date.now() >= readDeadline || lifetime.signal.aborted || performance.now() >= lifetime.monotonicDeadline) throw fail()
   const session = await createRoutingNetworkNativeSession({ sourceOperationId: initial.operationId,
     context: { principal: initial.principal, connection, signal: lifetime.signal }, authorize, deadline: readDeadline, manifest })
-  try { await authorize(); return session }
+  try {
+    await authorize()
+    if (manual) manualEffectOwners.add(session.sharedContext)
+    return session
+  }
   catch (error) { session.close(); throw error }
 }

backend/src/modules/mcp/routing-original-effects-caller.test.mjs

@@ -43,6 +43,7 @@ for(const mode of ['legacy','unknown'])test(`existing ${mode} manual path does n
 for(const failure of ['open','baseline','round','round-closed','publication'])test(`optional ${failure} uncertainty preserves actual manual config/control receipt with effects unknown`,async()=>{const f=await fixture('prepared',failure),result=await f.run();assert.equal(result.configurationVerified,true);assert.equal(result.controlProbeVerified,true);assert.equal(result.originalEffects.status,'unknown');assert.equal(f.calls.filter(x=>x==='PATCH').length,1);assert(f.calls.includes('save-network'));});
 test('foreign configuration drift after optional effect observations still refuses publication, never repeats PATCH',async()=>{const f=await fixture('prepared','foreign');await assert.rejects(f.run);assert.equal(f.calls.filter(x=>x==='PATCH').length,1);assert(!f.calls.includes('save-network'));assert.equal(f.stats().closed,1);});
 test('revision2 remains on existing manual path even with a prepared-like field',async()=>{const f=await fixture();f.input.proofRevision=2;await f.run();assert(!f.calls.includes('open-session'));});
+test('sealed manual policy runs read-only rounds through the real scoped consumer',async()=>{const f=await fixture();f.input.proofRevision=2;f.input.manualEffectPolicy='observational-v1';const result=await f.run();assert.equal(f.calls.filter(x=>x==='PATCH').length,1);assert(f.calls.includes('round:2'));assert.equal(result.originalEffects.status,'observed-expected');});
 test('actual preparation consumes the required real-context selection method and includes it in sealed service input',async()=>{const f=await fixture(),evidence=await f.prepare();assert(f.calls.includes('capture-prepared-selection'));assert.deepEqual(evidence.steps[0].input.originalEffectSelection,f.input.originalEffectSelection);assert.equal(evidence.steps[0].input.requestProof,'seal');assert(!f.calls.includes('PATCH'));});
 test('closed effect owner falls back to exactly the old final context read without bypassing publication guard',async()=>{const legacy=await fixture('legacy');await legacy.run();const f=await fixture('prepared','round-closed');await f.run();assert(!f.calls.includes('shared-publication'));assert.equal(f.stats().reads,legacy.stats().reads);});