fix(rectification): bind evidence to current server turn

frontend/tests/rectification-v9-evidence.test.ts

@@ -22,7 +22,6 @@ import {
   receiptHandlers,
 } from "./rectification-v9-test-support.ts";
 
-const SOURCE_TURN_ID = "77777777-7777-4777-8777-777777777777";
 
 function toolContext(overrides: {
   accounting?: ReturnType<typeof fakeAccounting>;
@@ -47,14 +46,13 @@ function toolContext(overrides: {
   };
 }
 
-test("propose-evidence schema rejects model-provided ids, birth data and ranges", async () => {
+test("propose-evidence binds the server-owned current turn and rejects model-provided ids, birth data and ranges", async () => {
   const { tools } = toolContext();
   const schema = (tools as Record<string, { inputSchema?: { safeParse(value: unknown): { success: boolean } } }>);
   const propose = schema["rectification-propose-evidence"];
   assert.ok(propose?.inputSchema);
   const valid = propose.inputSchema!.safeParse({
     caseId: CASE_ID,
-    sourceTurnId: SOURCE_TURN_ID,
     quote: "2016年9月离开家去北京工作",
     proposedKind: "career_entry",
     subject: "self",
@@ -65,9 +63,21 @@ test("propose-evidence schema rejects model-provided ids, birth data and ranges"
   });
   assert.equal(valid.success, true);
 
+  const withTurnId = propose.inputSchema!.safeParse({
+    caseId: CASE_ID,
+    sourceTurnId: "77777777-7777-4777-8777-777777777777",
+    quote: "2016年9月离开家去北京工作",
+    proposedKind: "career_entry",
+    subject: "self",
+    domain: "career",
+    datePrecision: "month",
+    occurredFrom: "2016-09",
+    summary: "2016年9月离家去北京工作",
+  });
+  assert.equal(withTurnId.success, false);
+
   const withModelId = propose.inputSchema!.safeParse({
     caseId: CASE_ID,
-    sourceTurnId: SOURCE_TURN_ID,
     quote: "2016年9月离开家去北京工作",
     proposedKind: "career_entry",
     datePrecision: "month",
@@ -78,7 +88,6 @@ test("propose-evidence schema rejects model-provided ids, birth data and ranges"
 
   const withBirthData = propose.inputSchema!.safeParse({
     caseId: CASE_ID,
-    sourceTurnId: SOURCE_TURN_ID,
     quote: "2016年9月离开家去北京工作",
     proposedKind: "career_entry",
     datePrecision: "month",
@@ -89,7 +98,6 @@ test("propose-evidence schema rejects model-provided ids, birth data and ranges"
 
   const withRange = propose.inputSchema!.safeParse({
     caseId: CASE_ID,
-    sourceTurnId: SOURCE_TURN_ID,
     quote: "2016年9月离开家去北京工作",
     proposedKind: "career_entry",
     datePrecision: "month",
@@ -113,7 +121,6 @@ test("quote must be grounded in the source turn's own message", async () => {
       execute(input: unknown): Promise<unknown>;
     }).execute({
       caseId: CASE_ID,
-      sourceTurnId: SOURCE_TURN_ID,
       quote: "这段话根本不在用户消息里",
       proposedKind: "career_entry",
       subject: "self",
@@ -133,7 +140,6 @@ test("year-only evidence keeps year precision and normalizes to a year start", a
     execute(input: unknown): Promise<unknown>;
   }).execute({
     caseId: CASE_ID,
-    sourceTurnId: SOURCE_TURN_ID,
     quote: "2016年离开家去北京开始工作",
     proposedKind: "career_entry",
     subject: "self",
@@ -144,6 +150,7 @@ test("year-only evidence keeps year precision and normalizes to a year start", a
   });
   const proposeCall = accounting.calls.find((call) => call.fn === "propose_agentic_rectification_evidence");
   assert.ok(proposeCall);
+  assert.equal(proposeCall.args.p_source_turn_id, TURN_ID);
   assert.equal(proposeCall.args.p_date_precision, "year");
   assert.equal(proposeCall.args.p_occurred_from, "2016-01-01");
   // The model cannot supply an evidence id; the server generates it.
@@ -227,7 +234,6 @@ test("propose is idempotent: replay returns the existing draft without a second
     execute(input: unknown): Promise<{ idempotent: boolean }>;
   }).execute({
     caseId: CASE_ID,
-    sourceTurnId: SOURCE_TURN_ID,
     quote: "2016年9月离开家去北京工作",
     proposedKind: "career_entry",
     subject: "self",
@@ -262,7 +268,6 @@ test("terminal cases reject evidence writes", async () => {
       execute(input: unknown): Promise<unknown>;
     }).execute({
       caseId: CASE_ID,
-      sourceTurnId: SOURCE_TURN_ID,
       quote: "2016年9月离开家去北京工作",
       proposedKind: "career_entry",
       subject: "self",

frontend/tests/rectification-v9-status-security.test.ts

@@ -94,6 +94,43 @@ test("confirmed requires the engine gate plus explicit grounded consent", async
   );
 });
 
+test("confirm-birth-time binds consent to the server-owned current turn", async () => {
+  const accounting = fakeAccounting({
+    ...receiptHandlers,
+    confirm_agentic_rectification_birth_time: () => ({
+      success: true,
+      saved_time: "05:02",
+      status: "confirmed",
+      result_id: RESULT_ID,
+      case_status: "confirmed",
+      idempotent: false,
+    }),
+  });
+  const tools = createRectificationV9Tools({
+    userId: USER_ID,
+    caseId: CASE_ID,
+    turnId: TURN_ID,
+    accounting: accounting.client as never,
+  });
+  const confirm = tools["rectification-confirm-birth-time"] as unknown as {
+    inputSchema: { safeParse(value: unknown): { success: boolean } };
+    execute(input: unknown): Promise<unknown>;
+  };
+  const input = {
+    caseId: CASE_ID,
+    resultId: RESULT_ID,
+    candidateId: "05:02",
+    consentQuote: "就用05:02",
+  };
+  assert.equal(confirm.inputSchema.safeParse(input).success, true);
+  assert.equal(confirm.inputSchema.safeParse({ ...input, sourceTurnId: "77777777-7777-4777-8777-777777777777" }).success, false);
+
+  await confirm.execute(input);
+  const call = accounting.calls.find((item) => item.fn === "confirm_agentic_rectification_birth_time");
+  assert.ok(call);
+  assert.equal(call.args.p_source_turn_id, TURN_ID);
+});
+
 test("candidate ownership is case-scoped: the RPC always receives the case id", async () => {
   const accounting = fakeAccounting({
     accept_agentic_rectification_candidate_for_case: () => ({
@@ -152,7 +189,6 @@ test("terminal cases reject evidence writes and candidate actions", async () =>
   await assert.rejects(
     (tools["rectification-propose-evidence"] as unknown as { execute(input: unknown): Promise<unknown> }).execute({
       caseId: CASE_ID,
-      sourceTurnId: TURN_ID,
       quote: "2016年9月离开家去北京工作",
       proposedKind: "career_entry",
       subject: "self",