@cleocode/playbooks 2026.10.11 → 2026.10.12

package/dist/state.js

@@ -272,6 +272,16 @@ export function updatePlaybookApproval(db, approvalId, patch) {
         values.push(patch.reason ?? null);
     }
     if ('status' in patch && patch.status !== undefined) {
+        // A decided gate never changes its decision (playbook.approval.once, the
+        // same guard transitionGate applies): a peer would refuse the move, so
+        // the origin refuses it too (T12944).
+        const current = db
+            .prepare('SELECT status FROM playbook_approvals WHERE approval_id = ?')
+            .get(approvalId);
+        if (current && current.status !== 'pending' && current.status !== patch.status) {
+            // @sync-invariant playbook.approval.once a decided gate keeps its decision locally, as every peer's merge keeps it
+            throw new Error(`E_APPROVAL_ALREADY_DECIDED: gate ${approvalId} is already ${current.status}`);
+        }
         sets.push('status = ?');
         values.push(patch.status);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/playbooks",
-  "version": "2026.10.11",
+  "version": "2026.10.12",
   "description": "Playbook DSL + runtime for CLEO — T889 Orchestration Coherence v3",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,8 +19,8 @@
   "dependencies": {
     "drizzle-orm": "1.0.0-rc.4",
     "js-yaml": "^4.1.0",
-    "@cleocode/core": "2026.10.11",
-    "@cleocode/contracts": "2026.10.11"
+    "@cleocode/contracts": "2026.10.12",
+    "@cleocode/core": "2026.10.12"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/src/__tests__/state.test.ts

@@ -218,6 +218,29 @@ describe('W4-8: playbook state CRUD', () => {
       expect(updated.reason).toBe('explicit human approval');
     });
 
+    it('updatePlaybookApproval refuses to change a decided gate, as transitionGate does (T12944)', () => {
+      const run = createPlaybookRun(db, { playbookName: 'p', playbookHash: 'h' });
+      const approval = createPlaybookApproval(db, {
+        runId: run.runId,
+        nodeId: 'approval-decided',
+        token: 'tok-decided-guard-00000000000000',
+      });
+      updatePlaybookApproval(db, approval.approvalId, { status: 'approved', approver: 'a' });
+      for (const status of ['pending', 'rejected'] as const) {
+        expect(() => updatePlaybookApproval(db, approval.approvalId, { status })).toThrow(
+          /E_APPROVAL_ALREADY_DECIDED/,
+        );
+      }
+      // The same decision and non-status fields still patch.
+      expect(
+        updatePlaybookApproval(db, approval.approvalId, { status: 'approved', reason: 'noted' })
+          .reason,
+      ).toBe('noted');
+      expect(getPlaybookApprovalByToken(db, 'tok-decided-guard-00000000000000')?.status).toBe(
+        'approved',
+      );
+    });
+
     it('listPlaybookApprovals returns rows in requestedAt order with stable secondary key', () => {
       const run = createPlaybookRun(db, {
         playbookName: 'p',

package/src/state.ts

@@ -414,6 +414,18 @@ export function updatePlaybookApproval(
     values.push(patch.reason ?? null);
   }
   if ('status' in patch && patch.status !== undefined) {
+    // A decided gate never changes its decision (playbook.approval.once, the
+    // same guard transitionGate applies): a peer would refuse the move, so
+    // the origin refuses it too (T12944).
+    const current = db
+      .prepare('SELECT status FROM playbook_approvals WHERE approval_id = ?')
+      .get(approvalId) as { status: string } | undefined;
+    if (current && current.status !== 'pending' && current.status !== patch.status) {
+      // @sync-invariant playbook.approval.once a decided gate keeps its decision locally, as every peer's merge keeps it
+      throw new Error(
+        `E_APPROVAL_ALREADY_DECIDED: gate ${approvalId} is already ${current.status}`,
+      );
+    }
     sets.push('status = ?');
     values.push(patch.status);
   }