Reality Transaction 与回滚

一个完整事务的骨架

transaction fix_login_timeout by agent {
  target "修复登录超时问题"
  affects object auth_service, object session_store
  allow paths ["src/auth/**"]
  deny paths ["infra/**", "src/billing/**"]

  provider vcs capability [read, write, revert]

  robust { ... }
  evidence require { ... }

  accept when ci.tests_passed and reviewer_approval.present
  abort when deny_paths.touched or regression_risk >= 0.3
  rollback to snapshot pre_change
}

回滚边界必须提前声明

rollback 描述的是可撤回的范围，不是"撤销一切"。 真正不可逆的部分要显式承认：

reversible none reason "跨行转账在受理后不可撤回"

这不是缺陷，而是让不可逆性进入审查视野。