fix(approval): replay immutable action responses

2026-07-16 15:49:43 +08:00
parent 4940ebc419
commit 28b834edd3
20 changed files with 552 additions and 60 deletions
--- a/document/development/2026-07-13/feature/ai-expense-closed-loop-and-value-proof/CONCEPT.md
+++ b/document/development/2026-07-13/feature/ai-expense-closed-loop-and-value-proof/CONCEPT.md
@@ -136,9 +136,11 @@
 - 当前首个可用切片由 `/api/v1/approval-workbench/items` 返回统一投影，优先级由风险、SLA、预算、金额和证据完整度共同计算，并返回每个分项、排序原因和仅供参考的 AI 建议；前端展示状态与服务端业务状态分离，避免乐观并发前置条件被中文标签覆盖。
 - 批准、退回和付款均使用动作协议：客户端在确认时冻结 `request_id`、预期状态和预期审批节点；服务端以租户 + 操作人 + 请求 ID 唯一账本、请求指纹、PostgreSQL advisory lock、Claim 行锁和同事务业务事件确保相同请求可安全重放，不同内容或陈旧快照以 409 拒绝。
 - 高风险门禁同时读取持久化风险观察和尚未落表的原始风险标记；未处置的严重/高危可行动风险在路由、预算和状态修改前阻断，原始重大风险持久化失败时 fail-closed。仅明确标记为 `route_review` 的路由型风险进入对应审批节点而不冒充已解决。
+- 门禁只消费与当前单据业务阶段一致的显式风险：申请阶段不会被明确标记为 `reimbursement` 的风险阻断，反之亦然；缺少阶段的未知重大风险仍保守处理。`route_review` 是显式路由语义，审批路由可以继续但风险仍保留在证据和后续复核中。
 - 风险处置采用判定与生命周期双状态：支持确认风险、误报、补件、开始整改、申请豁免和完成处置；每个动作绑定请求指纹、预期版本、操作人和只追加事件。完整证据只对管理员或当前审批人开放，风险池对财务/管理/预算角色开放，处置写入由管理员或锁内重新确认的当前审批人完成。
 - 并发锁顺序固定为 Claim → RiskObservation → RiskDisposition，审批动作、人工处置和 Hermes 扫描共用 Claim 锁。扫描在锁外计算、锁内校验状态与更新时间，过期快照丢弃并等待下一轮，避免旧图结果覆盖刚完成的人工处置。
- 尚未完成边界：工作台当前仍为服务内排序后截断；SLA 仍基于申请提交时间而不是当前节点进入时间；批量审批、委托/转交、加签/会签、豁免批准/拒绝和原始响应快照重放将在本阶段后续切片完成。
+- 所有单据动作首次完整 API 响应写入动作账本；风险处置首次完整响应在 append-only 事件 INSERT 前原子写入。相同请求重放只返回首次版本，风险旧事件无快照时也只从目标版本及以前的审计链重建，不读取当前 Claim、当前处置投影或后续事件。
+- 尚未完成边界：工作台当前仍为服务内排序后截断；SLA 仍基于申请提交时间而不是当前节点进入时间；批量审批、委托/转交、加签/会签和豁免批准/拒绝将在本阶段后续切片完成。

 #### CFO 价值看板

@@ -550,6 +552,7 @@ docker exec -w /app -e SERVER_VENV_DIR=/tmp/x-financial-server-venv \
 - 2026-07-16（风险门禁与处置）：高危/严重可行动风险在任何审批副作用前阻断；类型化风险处置覆盖确认、误报、补件、整改、豁免申请和完成处置，具备乐观版本、权限守卫和只追加审计。门禁合并持久观察与未匹配原始风险，重大观察落库失败 fail-closed；审批、处置和 Hermes 扫描通过 Claim 公共锁协调，扫描过期快照不会覆盖新事实。
 - 2026-07-16（审批工作台）：审批中心接入可解释优先级投影，展示风险、预算、金额、等待时长、证据完整度和 advisory-only AI 建议；风险证据卡读取真实持久字段、显示生命周期和明确动作，但不提供绕过风险门禁的直接审批入口。
 - 2026-07-16（审批与风险验证）：容器内审批/风险/费用服务组合 174 项、迁移/所有权 54 项、前端 73 项及 Vite 生产构建通过；一次性 tmpfs PostgreSQL 17 完成 13 项迁移和 1 项真实并发验证，临时数据库自动清理且持久开发库未修改。变更 Python 文件 Ruff F/I 与 `git diff --check` 通过。
+- 2026-07-16（严格响应重放）：修复审批和风险动作只保证副作用幂等、却在重放时返回当前投影的问题。审批账本保存完整 `ExpenseClaimRead`；风险 append-only 事件通过 `20260716_0012` 保存完整处置响应。单据或风险后续推进后，旧请求只返回首次快照和当时事件，不暴露后续状态；历史无快照事件按目标版本安全重建。门禁同步增加申请/报销阶段匹配和显式 `route_review` 路由语义。容器内审批、费用 Case、路由、风险和严格重放组合 182 项通过，一次性 PostgreSQL 17 迁移与并发共 17 项通过。
 - 2026-07-16（分层组织记忆）：`travel_application.transport_mode` 已形成当前输入/规则 > 企业 > 部门 > 个人的解析链。租户管理员可维护 30-365 天有效的企业/部门低敏记忆；同级冲突 fail-closed，低级覆盖、过期和撤销均返回可解释但脱敏的状态。创建、更新、撤销使用作用域锁、稳定幂等键和请求指纹，响应丢失可安全重放，请求内容变化返回冲突。
 - 2026-07-16（租户化历史案例）：风险观测、人工反馈、few-shot 关系数据和 Qdrant 向量统一绑定租户、场景、制度和规则版本；Hermes 按租户分别构建图与历史，风险规则生成不再回落到默认租户。报销预审与 AI 助手接入只读 `historical_case_evidence`，旧版本显式标 stale，检索故障降级为空证据。
 - 2026-07-16（历史证据隐私边界）：公开协议仅返回“历史已确认/历史误报，仅供复核”的固定摘要，不暴露样本 ID、费用单号、人工评论和历史结论原文；历史命中不改变 review ID、规则 findings、passed、blocking count、预算复核或审批路由。
--- a/document/development/2026-07-13/feature/ai-expense-closed-loop-and-value-proof/TODO.md
+++ b/document/development/2026-07-13/feature/ai-expense-closed-loop-and-value-proof/TODO.md
@@ -168,14 +168,17 @@

 - [x] [CONCEPT: 审批例外工作台] 按风险、金额、预算影响、等待时长和证据完整度排序审批事项。
  证据：`GET /api/v1/approval-workbench/items` 由 `ApprovalWorkbenchService` 统一生成可解释优先级、风险/SLA/预算/金额/证据分项和排序原因；审批中心使用该投影，不再用前端临时状态覆盖服务端乐观并发状态。
- [x] [CONCEPT: 审批例外工作台] 展示必要性、预算、政策、相似单、风险证据和 AI 意见草稿。
+- [x] [CONCEPT: 审批例外工作台] 展示预算压力、风险证据、材料完整度、历史标签和简短 AI 复核建议。
  证据：工作台返回证据完整度、缺失证据、预算影响、风险摘要、历史确认标签及 `advisory_only` AI 建议；详情页风险卡读取持久化证据、政策依据、贡献度和决策轨迹，并明确禁止从风险卡直接审批。
+- [ ] [CONCEPT: 审批例外工作台] 补齐统一必要性摘要、完整政策/相似单证据和可编辑审批意见草稿。
 - [x] [CONCEPT: 审批例外工作台] 为批准、退回和付款建立幂等动作协议与乐观前置条件。
-  证据：动作请求冻结 `request_id`、`expected_status` 和 `expected_approval_stage`；服务端以租户 + 操作人 + 请求 ID 唯一账本、请求指纹、advisory lock、Claim 行锁和同事务事件保证同请求安全重放，不同内容或过期快照返回 409。
+  证据：动作请求冻结 `request_id`、`expected_status` 和 `expected_approval_stage`；服务端以租户 + 操作人 + 请求 ID 唯一账本、请求指纹、advisory lock、Claim 行锁和同事务事件保证同请求安全重放，不同内容或过期快照返回 409。首次完整 API 响应以不可变快照落账，单据后续推进后重放仍只返回首次结果，不读取或泄露后续状态。
+- [x] [CONCEPT: 审批例外工作台] 为风险处置动作建立不可变原响应快照和历史安全重放。
+  证据：`20260716_0012` 为 append-only 风险事件增加 `response_json`；新事件在 INSERT 前原子写入完整响应，重放只返回目标事件版本及以前的事件。0012 前无快照事件从 `after_json` 与 `version <= target` 的审计链安全重建，不读取当前处置投影。
 - [x] [CONCEPT: 审批例外工作台] 建立高风险门禁与类型化风险处置生命周期。
  证据：严重/高危可行动风险在任何审批副作用前阻断；确认风险、误报、补件、整改、豁免申请和完成处置具有乐观版本、请求指纹、租户权限、只追加事件和 Claim 共用锁。未持久化的原始高风险仍保守阻断，重大风险持久化失败 fail-closed。
 - [ ] [CONCEPT: 审批例外工作台] 补齐批量审批、委托、转交、加签、会签和超时升级交互。
-  当前进度：单笔批准/退回/付款协议、优先级工作台、风险证据和处置状态已完成；批量动作、委托/转交、加签/会签、当前节点进入时间 SLA、豁免批准/拒绝及真正的数据库分页尚未实现，不以现有单笔基础冒充完成。
+  当前进度：单笔批准/退回/付款协议、原响应快照重放、优先级工作台、风险证据和处置状态已完成；批量动作、委托/转交、加签/会签、当前节点进入时间 SLA、豁免批准/拒绝及真正的数据库分页尚未实现，不以现有单笔基础冒充完成。
 - [ ] [CONCEPT: 审批例外工作台] 接入真实企微/钉钉/邮件触达和处理结果回写。
 - [ ] [CONCEPT: AI 记忆与自动化设置] 新增“我的 AI 记忆”，支持来源解释、修改、忘记和关闭个性化。
 - [x] [CONCEPT: AI 记忆与自动化设置] 在申请核对表展示常用出行方式的记忆来源、证据数量和“忘记此偏好”，并在保存/提交后区分候选记录与已应用回执。
@@ -222,9 +225,9 @@
  证据：`test_expense_case_endpoints.py` 容器内 8 项通过，覆盖跨租户、无 Case、申请与报销关联摘要以及内部字段递归过滤。
 - [ ] [CONCEPT: 测试方案] 为 Alembic baseline、升级、旧数据迁移和回滚边界补充 Postgres 集成测试。
 - [x] [CONCEPT: 测试方案] 为当前 migration-owned schema 切片补充一次性 PostgreSQL 集成测试和危险 URL 防误连门禁。
-  证据：`test_alembic_migrations.py` 默认无显式 URL 时跳过，主机和库名必须带 disposable 标记；当前 0011 Head 在 tmpfs PostgreSQL 17 中 13 项通过，覆盖空库升级、重复升级、审批动作账本、风险处置复合租户约束、只追加事件触发器、非空降级保护、组织 active 脏数据升级前拒绝、版本化 few-shot 无损降级拒绝、外键级联、base 降级、legacy 哨兵保留、漂移拒绝和再次升级；临时容器自动清理，持久化开发库未被修改。完整 legacy baseline 仍保留在上一条未完成项中。
+  证据：`test_alembic_migrations.py` 默认无显式 URL 时跳过，主机和库名必须带 disposable 标记；当前 0012 Head 在 tmpfs PostgreSQL 17 中通过完整迁移验证，覆盖空库升级、重复升级、审批动作账本、风险处置复合租户约束、只追加事件触发器、不可变响应快照及有数据降级拒绝、组织 active 脏数据升级前拒绝、版本化 few-shot 无损降级拒绝、外键级联、base 降级、legacy 哨兵保留、漂移拒绝和再次升级；临时容器自动清理，持久化开发库未被修改。完整 legacy baseline 仍保留在上一条未完成项中。
 - [x] [CONCEPT: 测试方案] 验证审批动作幂等、风险门禁、风险处置权限和共同锁顺序。
-  证据：容器内审批/风险/费用服务组合 174 项、迁移/所有权 54 项、前端审批/风险 73 项通过；一次性 PostgreSQL 17 上 13 项迁移和 1 项真实并发用例通过，证明风险重新打开持有 Claim 锁时审批等待，随后按最新风险阻断且不留下动作账本或审批副作用。
+  证据：容器内审批、费用 Case、路由、租户、风险和严格重放组合 182 项，迁移/所有权 54 项、前端审批/风险 73 项通过；一次性 PostgreSQL 17 上迁移与真实并发共 17 项通过，证明风险重新打开持有 Claim 锁时审批等待，随后按最新风险阻断且不留下动作账本或审批副作用。
 - [ ] [CONCEPT: 测试方案] 为连接器幂等、重试、回执、失败恢复、重复付款和对账补充测试。
 - [ ] [CONCEPT: 测试方案] 跑通申请 → 票据 → 报销 → 预审 → 审批 → 付款 → 入账 → 归档端到端。
  当前进度：申请批准 → 自动报销草稿 → 票据归集 → 预审 → 报销提交已在同一 Case 中跑通；付款回执、ERP 入账和对账仍未接入。
--- a/document/development/2026-07-16/dev-logs/bugs/approval-action-concurrency-and-risk-gate.md
+++ b/document/development/2026-07-16/dev-logs/bugs/approval-action-concurrency-and-risk-gate.md
@@ -8,3 +8,8 @@
 - 2026-07-16 15:33:03 CST：交叉审查后修复三项并发绕过：审批动作不再调用会隐式提交的读取修复逻辑，列表/分页 GET 也不再修改审批节点；审批中心保留服务端原始状态并单独生成展示标签；门禁将持久化风险观察与未匹配原始高风险合并，重大观察持久化失败时 fail-closed。
 - 2026-07-16 15:33:03 CST：审批、风险处置和 Hermes 扫描统一以 Claim 行锁为公共协调点，锁顺序固定为 Claim → Observation → Disposition；Hermes 锁外计算、锁内刷新并核对状态和更新时间，旧快照被丢弃。一次性 PostgreSQL 并发用例证明风险重新打开与审批竞争时，审批等待后读取最新风险并阻断，Claim 节点和动作账本均保持无副作用。
 - 2026-07-16 15:33:03 CST：最终容器回归为审批/风险/费用服务 174 项、迁移/所有权 54 项、前端审批/风险 73 项通过，Vite 生产构建通过；一次性 tmpfs PostgreSQL 17 上 13 项迁移和 1 项真实并发测试通过，临时数据库自动清理。再次执行 Git 拉取检查，上游仍无新增提交，本地 ahead 14。
+- 2026-07-16 15:44:39 CST：提交后交叉审查发现“副作用幂等”不等于“响应幂等”：动作账本虽然已有 `response_json`，重放却重新读取当前 Claim，后续节点变化会返回新状态。现改为首次动作在同一事务保存完整 `ExpenseClaimRead`，首次和重放均从该快照构造响应；快照缺失、单据/状态/节点身份不一致时 fail-closed 返回冲突，不再退回当前投影。
+- 2026-07-16 15:44:39 CST：新增“首次批准 → 单据继续推进并写入后续内部状态 → 旧 request_id 重放”服务和 HTTP 回归，确认响应逐字段等于首次结果、后续风险字段不泄露、数据库当前状态不被回退；审批动作与报销接口组合 29 项通过。
+- 2026-07-16 15:44:39 CST：再次完成 Git 拉取检查，上游无新增提交，本地 ahead 15，新增 ahead 为 `4940ebc4` 审批风险安全底座；用户维护的财务规则工作簿和历史日志继续保持未暂存。
+- 2026-07-16 15:48:38 CST：扩大回归范围后发现两个兼容边界：首次动作若直接返回 Pydantic 快照会破坏既有服务层 ORM 可变语义，因此首次执行继续返回已提交并刷新的 ORM，只有重放从不可变快照构造；HTTP 首次与重放仍逐字段一致。另为风险门禁增加申请/报销阶段匹配，显式错阶段风险不阻断当前流程，未知阶段重大风险仍 fail-closed。
+- 2026-07-16 15:48:38 CST：路由型重大风险统一使用显式 `route_review`，它允许当前审批进入预算/财务复核，但不会被标记为已解决；普通无 actionability 的原始重大风险继续阻断。容器内费用服务、审批路由、租户/Case、动作协议、接口和风险处置组合 182 项通过。
--- a/document/development/2026-07-16/dev-logs/bugs/risk-observation-access-and-lifecycle.md
+++ b/document/development/2026-07-16/dev-logs/bugs/risk-observation-access-and-lifecycle.md
@@ -8,3 +8,6 @@
 - 2026-07-16 15:33:03 CST：交叉审查后收紧处置动作语义：误报、补件和豁免申请必须提供服务端校验的说明，完成处置必须提供处理结果；版本冲突返回明确消息并触发前端刷新，已完成生命周期不再展示重复动作。
 - 2026-07-16 15:33:03 CST：处置服务在 Claim 公共锁内重新确认当前审批人，Observation 和 Disposition 使用租户范围行锁及固定顺序；风险观察写入同样获取 Claim 锁。完整证据、风险池和处置权限分别执行最小授权，跨租户和无权资源继续以 404 隐藏。
 - 2026-07-16 15:33:03 CST：最终验证全部在 `local-x-financial-linux` 容器完成并设置 60 秒超时；相关后端 174 项、迁移/所有权 54 项、前端 73 项与生产构建通过，一次性 PostgreSQL 17 的结构和并发验证 14 项通过。规则工作簿和历史未跟踪日志未被改动或纳入提交。
+- 2026-07-16 15:44:39 CST：交叉审查发现风险处置重放在权限复核前读取当前 Disposition 及全部事件，旧 request_id 可能看到首次动作之后的处置状态。新增 `20260716_0012`：完整响应在 append-only Event 的 INSERT 前原子写入 `response_json`，重放只返回该不可变快照并将 `replayed=true`；不得通过 UPDATE 补写审计事件。
+- 2026-07-16 15:44:39 CST：兼容 0012 前历史事件时，不回读当前 Disposition，只使用目标 Event 的 `after_json` 和 `version <= target` 的只追加事件重建；快照身份、租户、观察、处置、请求和版本任一不一致均 fail-closed。新增后续补件/整改后重放首个裁决的服务与 HTTP 回归，确认只返回版本 1 和当时事件。
+- 2026-07-16 15:44:39 CST：容器内风险处置、迁移和前置检查 69 项通过、1 项条件跳过，审批快照与报销接口 29 项通过；一次性 tmpfs PostgreSQL 17 的 0012 Head 迁移与审批风险真实并发共 17 项通过，临时数据库自动清理且持久开发库未修改。
--- a/server/alembic/versions/20260716_0012_risk_disposition_response_snapshot.py
+++ b/server/alembic/versions/20260716_0012_risk_disposition_response_snapshot.py
@@ -0,0 +1,57 @@
+"""add immutable risk disposition response snapshots
+
+Revision ID: 20260716_0012
+Revises: 20260716_0011
+Create Date: 2026-07-16 17:10:00
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "20260716_0012"
+down_revision: str | None = "20260716_0011"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def _require_postgresql() -> None:
+    dialect_name = op.get_bind().dialect.name
+    if dialect_name != "postgresql":
+        raise RuntimeError(
+            "20260716_0012 only supports PostgreSQL; "
+            f"refusing to mutate {dialect_name} without transactional JSON DDL"
+        )
+
+
+def _require_empty_response_snapshots_for_downgrade() -> None:
+    snapshot_count = int(
+        op.get_bind().scalar(
+            sa.text("SELECT COUNT(*) FROM risk_disposition_events WHERE response_json IS NOT NULL")
+        )
+        or 0
+    )
+    if snapshot_count:
+        raise RuntimeError(
+            "cannot downgrade risk disposition response snapshots: "
+            f"risk_disposition_events contains {snapshot_count} immutable snapshot(s)"
+        )
+
+
+def upgrade() -> None:
+    _require_postgresql()
+    op.add_column(
+        "risk_disposition_events",
+        sa.Column("response_json", sa.JSON(), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    _require_postgresql()
+    # 已写入事件快照受 append-only 触发器保护；降级不能静默删除审计响应。
+    _require_empty_response_snapshots_for_downgrade()
+    op.drop_column("risk_disposition_events", "response_json")
--- a/server/src/app/api/v1/endpoints/risk_observations.py
+++ b/server/src/app/api/v1/endpoints/risk_observations.py
@@ -199,11 +199,7 @@ def execute_risk_disposition_action(
        observation_key_or_id,
        payload,
    )
-    return RiskDispositionMutationRead(
-        disposition=mutation.disposition,
-        event=mutation.event,
-        replayed=mutation.replayed,
-    )
+    return mutation.response


@router.post(
--- a/server/src/app/db/migration_preflight.py
+++ b/server/src/app/db/migration_preflight.py
@@ -170,8 +170,29 @@ MIGRATION_OWNED_TABLES_BY_REVISION: dict[str, frozenset[str]] = {
            "approval_action_ledgers",
        }
    ),
+    "20260716_0012": frozenset(
+        {
+            "expense_cases",
+            "expense_case_links",
+            "business_events",
+            "auth_sessions",
+            "attachment_association_jobs",
+            "ai_application_preview_decisions",
+            "ai_decisions",
+            "ai_decision_feedback",
+            "memory_entries",
+            "memory_evidence_links",
+            "risk_observations",
+            "risk_observation_feedback",
+            "risk_dispositions",
+            "risk_disposition_events",
+            "few_shot_samples",
+            "workflow_outcomes",
+            "approval_action_ledgers",
+        }
+    ),
 }
-if MIGRATION_OWNED_TABLES_BY_REVISION["20260716_0011"] != MIGRATION_OWNED_TABLES:
+if MIGRATION_OWNED_TABLES_BY_REVISION["20260716_0012"] != MIGRATION_OWNED_TABLES:
    raise RuntimeError("latest Alembic revision must own the centralized migration table set")

 # 0008 之前这三张表由旧 bootstrap / 风险服务按需创建。迁移前置检查允许
@@ -244,6 +265,7 @@ def _validate_connection(connection: Connection) -> MigrationPreflightState:
            "20260716_0009",
            "20260716_0010",
            "20260716_0011",
+            "20260716_0012",
        }
        else frozenset()
    )
--- a/server/src/app/models/risk_disposition.py
+++ b/server/src/app/models/risk_disposition.py
@@ -165,6 +165,7 @@ class RiskDispositionEvent(Base):
    comment: Mapped[str | None] = mapped_column(Text(), nullable=True)
    before_json: Mapped[dict[str, Any]] = mapped_column(JSON, nullable=False, default=dict)
    after_json: Mapped[dict[str, Any]] = mapped_column(JSON, nullable=False, default=dict)
+    response_json: Mapped[dict[str, Any] | None] = mapped_column(JSON, nullable=True)
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True),
        nullable=False,
--- a/server/src/app/services/approval_action_protocol.py
+++ b/server/src/app/services/approval_action_protocol.py
@@ -72,7 +72,6 @@ class ApprovalActionProtocol:
        expected_approval_stage: str | None,
        payload: Mapping[str, Any],
        claim_loader: Callable[[], ExpenseClaim | None],
-        replay_claim_loader: Callable[[], ExpenseClaim | None],
    ) -> ApprovalActionStart:
        tenant_id = ExpenseClaimTenantScopeMixin.normalize_tenant_id(current_user.tenant_id)
        actor_id = self._normalize_actor_id(current_user.username)
@@ -101,7 +100,7 @@ class ApprovalActionProtocol:
            if existing.completed_at is None:
                raise ApprovalActionConflictError("该审批动作仍在处理中，请稍后重试。")
            return ApprovalActionStart(
-                claim=replay_claim_loader(),
+                claim=None,
                ledger=existing,
                request_id=request_id,
                replayed=True,
--- a/server/src/app/services/expense_claim_action_protocol.py
+++ b/server/src/app/services/expense_claim_action_protocol.py
@@ -3,12 +3,17 @@ from __future__ import annotations
 from collections.abc import Callable, Mapping
 from typing import Any

+from pydantic import ValidationError
 from sqlalchemy import select

 from app.api.deps import CurrentUserContext
 from app.models.approval_action import ApprovalActionLedger
 from app.models.financial_record import ExpenseClaim
-from app.services.approval_action_protocol import ApprovalActionProtocol
+from app.schemas.reimbursement import ExpenseClaimRead
+from app.services.approval_action_protocol import (
+    ApprovalActionConflictError,
+    ApprovalActionProtocol,
+)
 from app.services.expense_claim_tenant_scope import ExpenseClaimTenantScopeMixin

 ClaimActionExecutor = Callable[
@@ -29,7 +34,7 @@ class ExpenseClaimActionProtocolMixin:
        expected_approval_stage: str | None,
        payload: Mapping[str, Any],
        executor: ClaimActionExecutor,
-    ) -> ExpenseClaim | None:
+    ) -> ExpenseClaim | ExpenseClaimRead | None:
        protocol = ApprovalActionProtocol(self.db)
        tenant_id = ExpenseClaimTenantScopeMixin.normalize_tenant_id(current_user.tenant_id)
        actor_id = str(current_user.username or "").strip().casefold()
@@ -51,18 +56,16 @@ class ExpenseClaimActionProtocolMixin:
                        claim_id,
                        current_user,
                    ),
-                    replay_claim_loader=lambda: self._load_claim_for_replay(
-                        claim_id,
-                        current_user,
-                    ),
                )
+                if started.replayed:
+                    if started.ledger is None:  # pragma: no cover - defensive invariant
+                        raise RuntimeError("审批动作重放账本缺失。")
+                    response = self._response_from_ledger(started.ledger)
+                    self.db.commit()
+                    return response
                if started.claim is None:
                    self.db.rollback()
                    return None
-                if started.replayed:
-                    self.db.commit()
-                    self.db.refresh(started.claim)
-                    return self._access_policy.attach_approval_snapshot(started.claim)
                if started.ledger is None:  # pragma: no cover - defensive invariant
                    raise RuntimeError("审批动作账本初始化失败。")

@@ -71,14 +74,16 @@ class ExpenseClaimActionProtocolMixin:
                    started.ledger,
                    normalized_request_id,
                )
+                self.db.flush()
+                self.db.refresh(claim)
+                response = ExpenseClaimRead.model_validate(
+                    self._access_policy.attach_approval_snapshot(claim)
+                )
+                response_json = response.model_dump(mode="json")
                protocol.complete(
                    started.ledger,
                    claim,
-                    response_json={
-                        "claim_id": claim.id,
-                        "status": str(claim.status or "").strip(),
-                        "approval_stage": str(claim.approval_stage or "").strip(),
-                    },
+                    response_json=response_json,
                )
                self.db.commit()
                self.db.refresh(claim)
@@ -108,13 +113,22 @@ class ExpenseClaimActionProtocolMixin:
            self._repair_duplicate_budget_approval_stage(claim)
        return claim

-    def _load_claim_for_replay(
-        self,
-        claim_id: str,
-        current_user: CurrentUserContext,
-    ) -> ExpenseClaim | None:
-        stmt = select(ExpenseClaim).where(
-            ExpenseClaim.id == claim_id,
-            ExpenseClaimTenantScopeMixin.build_claim_tenant_condition(current_user.tenant_id),
-        )
-        return self.db.scalar(stmt)
+    @staticmethod
+    def _response_from_ledger(ledger: ApprovalActionLedger) -> ExpenseClaimRead:
+        try:
+            response = ExpenseClaimRead.model_validate(ledger.response_json)
+        except (TypeError, ValueError, ValidationError) as error:
+            raise ApprovalActionConflictError(
+                "该审批动作缺少可验证的原始响应快照，请刷新单据后使用新的 request_id。"
+            ) from error
+        if str(response.id) != str(ledger.claim_id):
+            raise ApprovalActionConflictError("审批动作原始响应快照与单据不一致。")
+        if str(response.status or "").strip().lower() != str(
+            ledger.result_status or ""
+        ).strip().lower():
+            raise ApprovalActionConflictError("审批动作原始响应快照状态校验失败。")
+        if str(response.approval_stage or "").strip() != str(
+            ledger.result_approval_stage or ""
+        ).strip():
+            raise ApprovalActionConflictError("审批动作原始响应快照节点校验失败。")
+        return response
--- a/server/src/app/services/expense_claim_return_flow.py
+++ b/server/src/app/services/expense_claim_return_flow.py
@@ -6,6 +6,7 @@ from datetime import UTC, datetime
 from app.api.deps import CurrentUserContext
 from app.models.approval_action import ApprovalActionLedger
 from app.models.financial_record import ExpenseClaim
+from app.schemas.reimbursement import ExpenseClaimRead
 from app.services.expense_claim_constants import RETURN_REASON_OPTIONS


@@ -20,7 +21,7 @@ class ExpenseClaimReturnFlowMixin:
        request_id: str | None = None,
        expected_status: str | None = None,
        expected_approval_stage: str | None = None,
-    ) -> ExpenseClaim | None:
+    ) -> ExpenseClaim | ExpenseClaimRead | None:
        normalized_reason = str(reason or "").strip()
        reason_code_payload = self._normalize_return_reason_code_payload(reason_codes)
        normalized_codes = [
--- a/server/src/app/services/expense_claim_risk_gate.py
+++ b/server/src/app/services/expense_claim_risk_gate.py
@@ -8,11 +8,16 @@ from sqlalchemy.orm import Session
 from app.models.financial_record import ExpenseClaim
 from app.models.risk_disposition import RiskDisposition
 from app.models.risk_observation import RiskObservation
+from app.services.document_numbering import is_application_claim_no
 from app.services.expense_claim_risk_flags import (
    claim_risk_flag_observation_key,
    claim_risk_flag_severity,
    is_blocking_claim_risk_flag,
 )
+from app.services.expense_claim_risk_stage import (
+    risk_business_stage_for_claim,
+    risk_flag_business_stage,
+)
 from app.services.expense_claim_tenant_scope import ExpenseClaimTenantScopeMixin

 _BLOCKING_LEVELS = {"high", "critical", "danger"}
@@ -52,6 +57,7 @@ class ExpenseClaimRiskGate:
        tenant_id: str | None,
    ) -> list[BlockingRiskObservation]:
        normalized_tenant = ExpenseClaimTenantScopeMixin.normalize_tenant_id(tenant_id)
+        claim_business_stage = self._claim_business_stage(claim)
        rows = self.db.execute(
            select(RiskObservation, RiskDisposition)
            .outerjoin(
@@ -75,6 +81,12 @@ class ExpenseClaimRiskGate:
        materialized_keys: set[str] = set()
        for observation, disposition in rows:
            materialized_keys.add(str(observation.observation_key or "").strip())
+            observation_stage = risk_flag_business_stage(
+                {"control_stage": observation.control_stage},
+                default="",
+            )
+            if observation_stage and observation_stage != claim_business_stage:
+                continue
            level = str(observation.risk_level or "").strip().lower()
            if level not in _BLOCKING_LEVELS:
                continue
@@ -100,6 +112,9 @@ class ExpenseClaimRiskGate:
        for index, flag in enumerate(list(claim.risk_flags_json or [])):
            if not isinstance(flag, dict) or not is_blocking_claim_risk_flag(flag):
                continue
+            flag_stage = risk_flag_business_stage(flag, default="")
+            if flag_stage and flag_stage != claim_business_stage:
+                continue
            observation_key = claim_risk_flag_observation_key(flag, claim_id=claim.id)
            if observation_key and observation_key in materialized_keys:
                # 完整物化后的处置投影优先；仅对没有 Observation 的高风险兜底。
@@ -124,6 +139,16 @@ class ExpenseClaimRiskGate:
            )
        return blockers

+    @staticmethod
+    def _claim_business_stage(claim: ExpenseClaim) -> str:
+        expense_type = str(claim.expense_type or "").strip().lower()
+        is_application = (
+            is_application_claim_no(str(claim.claim_no or "").strip())
+            or expense_type == "application"
+            or expense_type.endswith("_application")
+        )
+        return risk_business_stage_for_claim(is_application_claim=is_application)
+
    def ensure_approvable(
        self,
        claim: ExpenseClaim,
--- a/server/src/app/services/expense_claim_risk_stage.py
+++ b/server/src/app/services/expense_claim_risk_stage.py
@@ -27,6 +27,7 @@ SUPPORTED_RISK_VISIBILITY_SCOPES = {
 SUPPORTED_RISK_ACTIONABILITIES = {
    "fixable_by_submitter",
    "review_decision",
+    "route_review",
    "budget_governance",
    "finance_check",
    "system_trace",
--- a/server/src/app/services/risk_dispositions.py
+++ b/server/src/app/services/risk_dispositions.py
@@ -6,7 +6,9 @@ import os
 import uuid
 from dataclasses import dataclass
 from datetime import UTC, datetime
+from typing import Any

+from pydantic import ValidationError
 from sqlalchemy import select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
@@ -16,7 +18,12 @@ from app.core.logging import get_logger
 from app.models.financial_record import ExpenseClaim
 from app.models.risk_disposition import RiskDisposition, RiskDispositionEvent
 from app.models.risk_observation import RiskObservation, RiskObservationFeedback
-from app.schemas.risk_disposition import RiskDispositionActionCreate
+from app.schemas.risk_disposition import (
+    RiskDispositionActionCreate,
+    RiskDispositionEventRead,
+    RiskDispositionMutationRead,
+    RiskDispositionRead,
+)
 from app.services.expense_claim_tenant_scope import ExpenseClaimTenantScopeMixin
 from app.services.risk_observation_access_policy import RiskObservationAccessPolicy

@@ -45,11 +52,21 @@ class RiskDispositionPermissionError(RuntimeError):

@dataclass(slots=True)
 class RiskDispositionMutation:
-    disposition: RiskDisposition
-    event: RiskDispositionEvent
-    replayed: bool
+    response: RiskDispositionMutationRead
    legacy_feedback: RiskObservationFeedback | None = None

+    @property
+    def disposition(self) -> RiskDispositionRead:
+        return self.response.disposition
+
+    @property
+    def event(self) -> RiskDispositionEventRead:
+        return self.response.event
+
+    @property
+    def replayed(self) -> bool:
+        return self.response.replayed
+

 class RiskDispositionService:
    def __init__(self, db: Session) -> None:
@@ -149,6 +166,7 @@ class RiskDispositionService:
            if current_version != payload.expected_version:
                raise RiskDispositionVersionConflictError(current_version)

+            mutation_at = datetime.now(UTC)
            if disposition is None:
                disposition = RiskDisposition(
                    id=str(uuid.uuid4()),
@@ -157,6 +175,8 @@ class RiskDispositionService:
                    adjudication=_initial_adjudication(observation),
                    lifecycle_status=_initial_lifecycle_status(observation),
                    version=0,
+                    created_at=mutation_at,
+                    updated_at=mutation_at,
                )
                self.db.add(disposition)

@@ -164,7 +184,7 @@ class RiskDispositionService:
            before = _state(disposition)
            _apply_action(disposition, observation, payload)
            disposition.version = current_version + 1
-            disposition.updated_at = datetime.now(UTC)
+            disposition.updated_at = mutation_at
            event = RiskDispositionEvent(
                id=str(uuid.uuid4()),
                tenant_id=normalized_tenant,
@@ -179,7 +199,16 @@ class RiskDispositionService:
                comment=payload.comment,
                before_json=before,
                after_json=_state(disposition),
+                created_at=mutation_at,
            )
+            response = self._build_response_snapshot(
+                disposition,
+                event,
+                prior_version=current_version,
+            )
+            # PostgreSQL 会拒绝 append-only 事件的后续 UPDATE，因此完整响应
+            # 必须和事件在同一条 INSERT 中原子写入。
+            event.response_json = response.model_dump(mode="json")
            self.db.add(event)
            legacy_feedback = self._append_safe_feedback(
                observation,
@@ -194,9 +223,7 @@ class RiskDispositionService:
                self.db.refresh(legacy_feedback)
                self._ingest_feedback_sample(observation, legacy_feedback)
            return RiskDispositionMutation(
-                disposition=disposition,
-                event=event,
-                replayed=False,
+                response=response,
                legacy_feedback=legacy_feedback,
            )
        except (LookupError, RiskDispositionConflictError, RiskDispositionPermissionError):
@@ -232,6 +259,49 @@ class RiskDispositionService:
            statement = statement.with_for_update()
        return self.db.scalar(statement.execution_options(populate_existing=True))

+    def _build_response_snapshot(
+        self,
+        disposition: RiskDisposition,
+        event: RiskDispositionEvent,
+        *,
+        prior_version: int,
+    ) -> RiskDispositionMutationRead:
+        prior_events = list(
+            self.db.scalars(
+                select(RiskDispositionEvent)
+                .where(
+                    RiskDispositionEvent.tenant_id == disposition.tenant_id,
+                    RiskDispositionEvent.disposition_id == disposition.id,
+                    RiskDispositionEvent.version <= prior_version,
+                )
+                .order_by(RiskDispositionEvent.version.asc())
+            ).all()
+        )
+        event_read = RiskDispositionEventRead.model_validate(event)
+        event_history = [
+            *[RiskDispositionEventRead.model_validate(item) for item in prior_events],
+            event_read,
+        ]
+        disposition_read = RiskDispositionRead(
+            id=disposition.id,
+            tenant_id=disposition.tenant_id,
+            observation_id=disposition.observation_id,
+            adjudication=disposition.adjudication,
+            lifecycle_status=disposition.lifecycle_status,
+            version=disposition.version,
+            assignee=disposition.assignee,
+            due_at=disposition.due_at,
+            resolution=disposition.resolution,
+            created_at=disposition.created_at,
+            updated_at=disposition.updated_at,
+            events=event_history,
+        )
+        return RiskDispositionMutationRead(
+            disposition=disposition_read,
+            event=event_read,
+            replayed=False,
+        )
+
    def _find_replay(
        self,
        *,
@@ -249,9 +319,7 @@ class RiskDispositionService:
            return None
        if event.payload_fingerprint != fingerprint:
            raise RiskDispositionIdempotencyConflictError("request_id 已被不同的风险处置内容使用。")
-        disposition = self.db.get(RiskDisposition, event.disposition_id)
-        if disposition is None:
-            raise RiskDispositionConflictError("Risk disposition replay target is missing.")
+        response = self._event_response(event)
        feedback = self.db.scalar(
            select(RiskObservationFeedback).where(
                RiskObservationFeedback.observation_id == event.observation_id,
@@ -259,12 +327,97 @@ class RiskDispositionService:
            )
        )
        return RiskDispositionMutation(
-            disposition=disposition,
-            event=event,
-            replayed=True,
+            response=response.model_copy(update={"replayed": True}),
            legacy_feedback=feedback,
        )

+    def _event_response(
+        self,
+        event: RiskDispositionEvent,
+    ) -> RiskDispositionMutationRead:
+        if isinstance(event.response_json, dict) and event.response_json:
+            try:
+                response = RiskDispositionMutationRead.model_validate(event.response_json)
+            except ValidationError as error:
+                raise RiskDispositionConflictError(
+                    "Stored risk disposition response snapshot is invalid."
+                ) from error
+            self._validate_snapshot_identity(event, response)
+            return response
+        return self._rebuild_legacy_event_response(event)
+
+    def _rebuild_legacy_event_response(
+        self,
+        event: RiskDispositionEvent,
+    ) -> RiskDispositionMutationRead:
+        # 0012 之前的事件没有响应快照。只读取目标版本及以前的 append-only
+        # 事件，并使用目标事件 after_json 重建；禁止读取当前 disposition。
+        history = list(
+            self.db.scalars(
+                select(RiskDispositionEvent)
+                .where(
+                    RiskDispositionEvent.tenant_id == event.tenant_id,
+                    RiskDispositionEvent.disposition_id == event.disposition_id,
+                    RiskDispositionEvent.version <= event.version,
+                )
+                .order_by(RiskDispositionEvent.version.asc())
+            ).all()
+        )
+        target = next((item for item in history if item.id == event.id), None)
+        if target is None:
+            raise RiskDispositionConflictError(
+                "Legacy risk disposition replay event is missing from its audit chain."
+            )
+        state: dict[str, Any] = dict(event.after_json or {})
+        event_reads = [RiskDispositionEventRead.model_validate(item) for item in history]
+        target_read = RiskDispositionEventRead.model_validate(target)
+        try:
+            disposition = RiskDispositionRead(
+                id=event.disposition_id,
+                tenant_id=event.tenant_id,
+                observation_id=event.observation_id,
+                adjudication=state.get("adjudication"),
+                lifecycle_status=state.get("lifecycle_status"),
+                version=event.version,
+                assignee=state.get("assignee"),
+                due_at=state.get("due_at"),
+                resolution=state.get("resolution"),
+                created_at=history[0].created_at,
+                updated_at=event.created_at,
+                events=event_reads,
+            )
+            response = RiskDispositionMutationRead(
+                disposition=disposition,
+                event=target_read,
+                replayed=False,
+            )
+        except ValidationError as error:
+            raise RiskDispositionConflictError(
+                "Legacy risk disposition response cannot be reconstructed safely."
+            ) from error
+        self._validate_snapshot_identity(event, response)
+        return response
+
+    @staticmethod
+    def _validate_snapshot_identity(
+        event: RiskDispositionEvent,
+        response: RiskDispositionMutationRead,
+    ) -> None:
+        if (
+            response.event.id != event.id
+            or response.event.request_id != event.request_id
+            or response.event.version != event.version
+            or response.disposition.id != event.disposition_id
+            or response.disposition.observation_id != event.observation_id
+            or response.disposition.tenant_id != event.tenant_id
+            or response.disposition.version != event.version
+            or not any(item.id == event.id for item in response.disposition.events)
+            or any(item.version > event.version for item in response.disposition.events)
+        ):
+            raise RiskDispositionConflictError(
+                "Risk disposition response snapshot does not match its immutable event."
+            )
+
    def _append_safe_feedback(
        self,
        observation: RiskObservation,
--- a/server/tests/test_alembic_migrations.py
+++ b/server/tests/test_alembic_migrations.py
@@ -28,7 +28,7 @@ from app.models.risk_observation import RiskObservation

 MIGRATION_TEST_DATABASE_URL = os.getenv("MIGRATION_TEST_DATABASE_URL", "").strip()
 LEGACY_PROBE_TABLE = "legacy_migration_probe_records"
-HEAD_REVISION = "20260716_0011"
+HEAD_REVISION = "20260716_0012"
 SERVER_DIR = Path(__file__).resolve().parents[1]
 ALEMBIC_INI_PATH = SERVER_DIR / "alembic.ini"

@@ -487,6 +487,14 @@ def _assert_head_schema(engine: Engine) -> None:
        ("tenant_id", "observation_id"),
        "risk_observations",
    )
+    risk_disposition_event_columns = {
+        str(item["name"])
+        for item in inspect(engine).get_columns(
+            "risk_disposition_events",
+            schema="public",
+        )
+    }
+    assert "response_json" in risk_disposition_event_columns
    with engine.connect() as connection:
        append_only_trigger_count = int(
            connection.scalar(
@@ -1325,6 +1333,8 @@ def _assert_base_schema(engine: Engine) -> None:
        ("20260716_0010_approval_action_protocol.py", "downgrade"),
        ("20260716_0011_risk_disposition.py", "upgrade"),
        ("20260716_0011_risk_disposition.py", "downgrade"),
+        ("20260716_0012_risk_disposition_response_snapshot.py", "upgrade"),
+        ("20260716_0012_risk_disposition_response_snapshot.py", "downgrade"),
    ],
 )
 def test_postgresql_only_migrations_reject_other_dialects_before_mutation(
@@ -1341,6 +1351,18 @@ def test_postgresql_only_migrations_reject_other_dialects_before_mutation(
    assert operation_guard.mutation_calls == []


+def test_risk_disposition_snapshot_migration_refuses_lossy_downgrade() -> None:
+    migration = _load_migration_module("20260716_0012_risk_disposition_response_snapshot.py")
+    operation_guard = _UnsupportedDialectOperationGuard(dialect_name="postgresql")
+    operation_guard.bind.scalar = lambda _statement: 1
+    migration.op = operation_guard
+
+    with pytest.raises(RuntimeError, match="contains 1 immutable snapshot"):
+        migration.downgrade()
+
+    assert operation_guard.mutation_calls == []
+
+
 def test_head_model_declares_soft_claim_reference_and_organization_only_active_index() -> None:
    claim_column = RiskObservation.__table__.c.claim_id
    assert not claim_column.foreign_keys
--- a/server/tests/test_expense_claim_action_protocol.py
+++ b/server/tests/test_expense_claim_action_protocol.py
@@ -15,6 +15,7 @@ from app.models.audit_log import AuditLog
 from app.models.employee import Employee
 from app.models.expense_case import BusinessEvent
 from app.models.financial_record import ExpenseClaim
+from app.schemas.reimbursement import ExpenseClaimRead
 from app.services.approval_action_protocol import (
    ApprovalActionConflictError,
    ApprovalActionProtocol,
@@ -117,6 +118,9 @@ def test_approve_replay_persists_one_ledger_event_and_audit(
        )

        assert first is not None and replay is not None
+        assert ExpenseClaimRead.model_validate(replay).model_dump(mode="json") == (
+            ExpenseClaimRead.model_validate(first).model_dump(mode="json")
+        )
        assert replay.approval_stage == "财务审批"
        assert db.scalar(select(func.count()).select_from(ApprovalActionLedger)) == 1
        assert db.scalar(select(func.count()).select_from(BusinessEvent)) == 1
@@ -130,6 +134,61 @@ def test_approve_replay_persists_one_ledger_event_and_audit(
        )


+def test_approve_replay_returns_original_snapshot_after_claim_moves_forward(
+    session_factory: sessionmaker[Session],
+) -> None:
+    with session_factory() as db:
+        claim = _seed_claim(db, claim_id="claim-action-original-response")
+        service = ExpenseClaimService(db)
+        first = service.approve_claim(
+            claim.id,
+            _manager_user(),
+            opinion="同意",
+            request_id="approve-original-response-1",
+            expected_status="submitted",
+            expected_approval_stage="直属领导审批",
+        )
+        assert first is not None
+        first_json = ExpenseClaimRead.model_validate(first).model_dump(mode="json")
+
+        current = db.get(ExpenseClaim, claim.id)
+        assert current is not None
+        current.status = "pending_payment"
+        current.approval_stage = "待付款"
+        current.risk_flags_json = [
+            *list(current.risk_flags_json or []),
+            {"source": "future_state", "message": "首次响应之后产生的内部状态"},
+        ]
+        db.commit()
+
+        replay = service.approve_claim(
+            claim.id,
+            _manager_user(),
+            opinion="同意",
+            request_id="approve-original-response-1",
+            expected_status="submitted",
+            expected_approval_stage="直属领导审批",
+        )
+
+        assert replay is not None
+        assert ExpenseClaimRead.model_validate(replay).model_dump(mode="json") == first_json
+        assert replay.approval_stage == "财务审批"
+        assert all(
+            item.get("source") != "future_state" for item in replay.risk_flags_json or []
+        )
+        persisted = db.get(ExpenseClaim, claim.id)
+        assert persisted is not None
+        assert persisted.status == "pending_payment"
+        assert persisted.approval_stage == "待付款"
+        ledger = db.scalar(
+            select(ApprovalActionLedger).where(
+                ApprovalActionLedger.request_id == "approve-original-response-1"
+            )
+        )
+        assert ledger is not None
+        assert ledger.response_json == first_json
+
+
 def test_request_id_payload_mismatch_and_stale_preconditions_return_conflict(
    session_factory: sessionmaker[Session],
 ) -> None:
--- a/server/tests/test_expense_claim_approval_routing.py
+++ b/server/tests/test_expense_claim_approval_routing.py
@@ -342,6 +342,7 @@ def test_high_risk_application_under_90_percent_routes_to_budget_manager() -> No
                {
                    "source": "submission_review",
                    "severity": "high",
+                    "actionability": "route_review",
                    "label": "申请信息风险",
                    "message": "申请事由需要领导关注。",
                    "business_stage": "expense_application",
@@ -477,7 +478,7 @@ def test_review_decision_high_risk_application_flows_from_pre_review_to_p8() ->
                {
                    "source": "manual_risk",
                    "severity": "high",
-                    "actionability": "review_decision",
+                    "actionability": "route_review",
                    "label": "特殊项目风险",
                    "message": "该项目需预算管理者确认。",
                    "business_stage": "expense_application",
@@ -619,6 +620,7 @@ def test_risky_reimbursement_routes_to_budget_then_finance() -> None:
                {
                    "source": "submission_review",
                    "severity": "high",
+                    "actionability": "route_review",
                    "label": "行程城市异常",
                    "message": "票据城市与申报目的地不一致",
                }
--- a/server/tests/test_migration_preflight.py
+++ b/server/tests/test_migration_preflight.py
@@ -145,6 +145,10 @@ def test_known_revision_requires_and_accepts_its_exact_owned_table_set(
            "20260716_0011",
            MIGRATION_OWNED_TABLES_BY_REVISION["20260716_0011"] - {"risk_disposition_events"},
        ),
+        (
+            "20260716_0012",
+            MIGRATION_OWNED_TABLES_BY_REVISION["20260716_0012"] - {"risk_disposition_events"},
+        ),
    ],
 )
 def test_known_revision_with_missing_or_unexpected_owned_tables_is_rejected(
--- a/server/tests/test_reimbursement_endpoints.py
+++ b/server/tests/test_reimbursement_endpoints.py
@@ -736,6 +736,17 @@ def test_approve_claim_endpoint_routes_direct_manager_claim_to_finance_review()
    assert approval_events[0]["operator"] == "李经理"
    assert "manager-approve-api@example.com" not in approval_events[0]["message"]

+    with session_factory() as db:
+        moved_forward = db.get(ExpenseClaim, "claim-approve-1")
+        assert moved_forward is not None
+        moved_forward.status = "pending_payment"
+        moved_forward.approval_stage = "待付款"
+        moved_forward.risk_flags_json = [
+            *list(moved_forward.risk_flags_json or []),
+            {"source": "future_state", "message": "首次响应之后的状态"},
+        ]
+        db.commit()
+
    replay_response = client.post(
        "/api/v1/reimbursements/claims/claim-approve-1/approve",
        json={
@@ -747,7 +758,11 @@ def test_approve_claim_endpoint_routes_direct_manager_claim_to_finance_review()
        headers=action_headers,
    )
    assert replay_response.status_code == 200
-    assert replay_response.json()["approval_stage"] == "财务审批"
+    assert replay_response.json() == payload
+    assert all(
+        item.get("source") != "future_state"
+        for item in replay_response.json()["risk_flags_json"]
+    )

    changed_payload_response = client.post(
        "/api/v1/reimbursements/claims/claim-approve-1/approve",
--- a/server/tests/test_risk_dispositions.py
+++ b/server/tests/test_risk_dispositions.py
@@ -228,6 +228,37 @@ def test_risk_disposition_idempotency_and_optimistic_version_are_enforced(
        assert replay.replayed is True
        assert replay.event.id == first.event.id
        assert db.scalar(select(func.count()).select_from(RiskDispositionEvent)) == 1
+        stored_event = db.get(RiskDispositionEvent, first.event.id)
+        assert stored_event is not None
+        assert stored_event.response_json is not None
+        assert stored_event.response_json["replayed"] is False
+        assert stored_event.response_json["disposition"]["version"] == 1
+
+        advanced = service.execute_action(
+            observation.id,
+            _action(
+                "start_remediation",
+                version=1,
+                request_id="request-remediation-after-idempotent",
+            ),
+            tenant_id="default",
+            actor_id="finance-1",
+            actor_name="财务甲",
+        )
+        late_replay = service.execute_action(
+            observation.id,
+            payload,
+            tenant_id="default",
+            actor_id="finance-1",
+            actor_name="财务甲",
+        )
+
+        assert advanced.disposition.version == 2
+        assert late_replay.replayed is True
+        assert late_replay.disposition.version == 1
+        assert late_replay.disposition.lifecycle_status == "open"
+        assert [item.version for item in late_replay.disposition.events] == [1]
+        assert db.scalar(select(func.count()).select_from(RiskDispositionEvent)) == 2

        with pytest.raises(RiskDispositionIdempotencyConflictError):
            service.execute_action(
@@ -268,7 +299,56 @@ def test_risk_disposition_idempotency_and_optimistic_version_are_enforced(
                actor_id="finance-1",
                actor_name="财务甲",
            )
-        assert error.value.current_version == 1
+        assert error.value.current_version == 2
+
+
+def test_legacy_event_replay_rebuilds_only_target_version_history(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("FEW_SHOT_INJECTION_ENABLED", "false")
+    with _build_session() as db:
+        observation = RiskObservationService(db).upsert_observation(
+            _observation_payload("risk:typed:legacy-replay")
+        )
+        db.commit()
+        service = RiskDispositionService(db)
+        payload = _action("confirm", version=0, request_id="request-legacy-replay-001")
+        first = service.execute_action(
+            observation.id,
+            payload,
+            tenant_id="default",
+            actor_id="finance-1",
+            actor_name="财务甲",
+        )
+        legacy_event = db.get(RiskDispositionEvent, first.event.id)
+        assert legacy_event is not None
+        legacy_event.response_json = None
+        db.commit()
+
+        service.execute_action(
+            observation.id,
+            _action(
+                "start_remediation",
+                version=1,
+                request_id="request-legacy-replay-later",
+            ),
+            tenant_id="default",
+            actor_id="finance-1",
+            actor_name="财务甲",
+        )
+        replay = service.execute_action(
+            observation.id,
+            payload,
+            tenant_id="default",
+            actor_id="finance-1",
+            actor_name="财务甲",
+        )
+
+        assert replay.replayed is True
+        assert replay.event.id == first.event.id
+        assert replay.disposition.version == 1
+        assert replay.disposition.lifecycle_status == "open"
+        assert [item.version for item in replay.disposition.events] == [1]


 def test_risk_observation_api_enforces_pool_claim_and_typed_action_permissions(
@@ -360,6 +440,26 @@ def test_risk_observation_api_enforces_pool_claim_and_typed_action_permissions(
            "comment": "人工复核确认",
        },
    )
+    advanced = client.post(
+        f"/api/v1/risk-observations/{observation_id}/disposition/actions",
+        headers=finance_headers,
+        json={
+            "action": "request_supplement",
+            "expected_version": 1,
+            "request_id": "api-supplement-request-001",
+            "comment": "请补充完整行程材料",
+        },
+    )
+    late_replay = client.post(
+        f"/api/v1/risk-observations/{observation_id}/disposition/actions",
+        headers=finance_headers,
+        json={
+            "action": "confirm",
+            "expected_version": 0,
+            "request_id": "api-confirm-request-001",
+            "comment": "人工复核确认",
+        },
+    )
    stale = client.post(
        f"/api/v1/risk-observations/{observation_id}/disposition/actions",
        headers=finance_headers,
@@ -410,6 +510,13 @@ def test_risk_observation_api_enforces_pool_claim_and_typed_action_permissions(
    assert replay.status_code == 200
    assert replay.json()["replayed"] is True
    assert replay.json()["event"]["id"] == first.json()["event"]["id"]
+    assert advanced.status_code == 200
+    assert advanced.json()["disposition"]["version"] == 2
+    assert late_replay.status_code == 200
+    assert late_replay.json()["replayed"] is True
+    assert late_replay.json()["disposition"]["version"] == 1
+    assert late_replay.json()["disposition"]["lifecycle_status"] == "open"
+    assert [item["version"] for item in late_replay.json()["disposition"]["events"]] == [1]
    assert stale.status_code == 409
    assert stale.json()["detail"]["code"] == "RISK_DISPOSITION_VERSION_CONFLICT"
    assert stale.json()["detail"]["message"] == "风险处置状态已更新，请刷新证据链后重试。"
@@ -423,8 +530,8 @@ def test_risk_observation_api_enforces_pool_claim_and_typed_action_permissions(
        headers=finance_headers,
    )
    assert detail.status_code == 200
-    assert detail.json()["disposition"]["version"] == 1
-    assert len(detail.json()["disposition"]["events"]) == 1
+    assert detail.json()["disposition"]["version"] == 2
+    assert len(detail.json()["disposition"]["events"]) == 2


 def test_current_claim_approver_can_manage_disposition_without_pool_access() -> None: