@sema-agent/server 7.93.2 → 7.93.3

package/USAGE.md

@@ -375,12 +375,20 @@ MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheap
   core 5.54.0 起拒启错误带**可分派 code**(`FileStoreLockError`,message 点名占用方 pid),运维按码
   三动作:`store.dir_in_use`=另一个活进程持有该目录 → 停掉它(或换数据根/迁 SQL 后端);
   `store.dir_claiming`=另一进程正在接管崩溃者留下的锁 → **瞬态,稍候重试**(接管方要么完成要么
-  自己也被收割);`store.lock_unreadable`=锁文件坏形(无 owner 可解析/嵌套接管残留)→ 人工处置,
-  message 会点名要删的文件,**不要盲删数据根下其它东西**。server 刻意不把这族错**吞掉**(fail-fast:
+  自己也被收割);`store.lock_unreadable`=锁**读不出可解析的 owner**
+  (真坏形:无 owner / 嵌套接管残留;**或者**本进程读不动它 —— core 把一切非 ENOENT 的读失败都折进这一码)
+  → 人工处置,message 会点名要删的东西(⚠️ 三条消息点名的**不是同一个**:`LOCK` / `LOCK.claim.*` / 本进程
+  自己那把删不掉的锁),且 core 的句子**带条件** ——「stale 才删」:读不动的那一形背后可能是个**活**写者
+  (权限/属主不对),盲删 = 拆掉围栏 ⇒ 两个写者共用一个数据根。**不要盲删数据根下其它东西**。
+  server 刻意不把这族错**吞掉**(fail-fast:
   两进程共用 file 数据目录是禁止形,静默容忍比拒启更坏)。
+  ⚠️ **拒启句本身就带这三条里对应的那一条出路**(不必再回来查这张表);拒启原因**不是**锁冲突时
+  (磁盘满 / 权限 / 只读挂载 …)拒启句**不加任何出路猜测** —— 此前它一律拼「另一个实例可能占着,停掉它」,
+  把运维送去找一个不存在的进程。HTTP 服务与 `run-local` 共用同一只派生,只有「换一个空目录」那半句按通道
+  措辞不同(`LOCAL_DATA_ROOT` / `--root`)。
   ⚠️ 自 7.93.1 起 `store.dir_in_use` **这一码**多一道有界等待(见下面 `STORE_LOCK_WAIT_MS` 那条):
-  拒启形与文案一格不变,只是拒之前会先在窗内反复重取;另两码(`dir_claiming` / `lock_unreadable`)
-  与非锁类失败**一秒都不等**,原样抛。
+  **等待腿本身**不改拒启形、也不改上面那句出路(它只在拒之前先在窗内反复重取,并在拒句里多写一句
+  `waited Nms`);另两码(`dir_claiming` / `lock_unreadable`)与非锁类失败**一秒都不等**,原样抛。
   `DB_BACKEND=memory` 并非全无盘:workflow 相关账本仍挂数据根下——多个 memory 形引擎**不要共用**
   数据根/HOME(1.309 起并发 boot 不再拒启,但账本内容级共享仍不受支持)。
 - **`STORE_LOCK_WAIT_MS`(缺省 `60000`,单位 ms)—— 撞上活持锁人时等一会儿再拒**:

package/dist/adoption/wire.d.ts

@@ -28,8 +28,8 @@ export declare const AdoptionSourceSchema: z.ZodObject<{
 export type AdoptionSource = z.infer<typeof AdoptionSourceSchema>;
 /** per-store 腿的动作词(183 §6 闭集;form b 只会产出前两个 + `none`)。 */
 export declare const AdoptionLegActionSchema: z.ZodEnum<{
-    reset: "reset";
     none: "none";
+    reset: "reset";
     "bucket-rebind": "bucket-rebind";
     "row-rewrite": "row-rewrite";
     carried: "carried";
@@ -38,8 +38,8 @@ export type AdoptionLegAction = z.infer<typeof AdoptionLegActionSchema>;
 export declare const AdoptionLegSchema: z.ZodObject<{
     store: z.ZodString;
     action: z.ZodEnum<{
-        reset: "reset";
         none: "none";
+        reset: "reset";
         "bucket-rebind": "bucket-rebind";
         "row-rewrite": "row-rewrite";
         carried: "carried";
@@ -109,8 +109,8 @@ export declare const AdoptionReportSchema: z.ZodObject<{
     legs: z.ZodArray<z.ZodObject<{
         store: z.ZodString;
         action: z.ZodEnum<{
-            reset: "reset";
             none: "none";
+            reset: "reset";
             "bucket-rebind": "bucket-rebind";
             "row-rewrite": "row-rewrite";
             carried: "carried";
@@ -170,8 +170,8 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
         legs: z.ZodArray<z.ZodObject<{
             store: z.ZodString;
             action: z.ZodEnum<{
-                reset: "reset";
                 none: "none";
+                reset: "reset";
                 "bucket-rebind": "bucket-rebind";
                 "row-rewrite": "row-rewrite";
                 carried: "carried";
@@ -214,8 +214,8 @@ export type AdoptionReceipt = z.infer<typeof AdoptionReceiptSchema>;
 export declare const AdoptionLegsSchema: z.ZodArray<z.ZodObject<{
     store: z.ZodString;
     action: z.ZodEnum<{
-        reset: "reset";
         none: "none";
+        reset: "reset";
         "bucket-rebind": "bucket-rebind";
         "row-rewrite": "row-rewrite";
         carried: "carried";

package/dist/approval-ask-audit-store.js

@@ -7,6 +7,11 @@ export const CRASH_CONVERGED_LIST_MAX = 200;
 export function buildCheckpointAnchorHash(token) {
     return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 16);
 }
+const HOST_DECIDED_BY_WORDS = ["person", "sla_timeout", "policy"];
+const HOST_DECIDED_BY = new Set(HOST_DECIDED_BY_WORDS);
+function isHostDecidedBy(v) {
+    return typeof v === "string" && HOST_DECIDED_BY.has(v);
+}
 function readLedgerRecord(u) {
     if (u === null || typeof u !== "object" || Array.isArray(u))
         return undefined;
@@ -87,7 +92,7 @@ function readLedgerRecord(u) {
             const decidedByV = o.decidedBy;
             const legacySettledByV = decidedByV === undefined ? o.settledBy : undefined;
             const legacySettledBy = legacySettledByV === "human" || legacySettledByV === "timeout" || legacySettledByV === "aborted" ? legacySettledByV : undefined;
-            const decidedBy = decidedByV === "person" || decidedByV === "sla_timeout" ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
+            const decidedBy = isHostDecidedBy(decidedByV) ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
             const approver = s("approver");
             const settledAtMs = num("settledAtMs");
             const sessionId = s("sessionId");

package/dist/boot/shutdown.d.ts

@@ -12,7 +12,8 @@
  *     "第二个信号"的语义读数。
  *  3. `clearInterval(reaper)` 必须是 hardShutdown 的第一件事(在 `server.close()` 之前),否则
  *     收尾期还会有 reaper tick 打向正在关闭的池。
- *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的五只(三信号 + [ref]① 双钩)只能经返回的
+ *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的六只(三信号 + [ref]① 双钩 + S-557 退出边界钩)
+ *     只能经返回的
  *     {@link ShutdownHandle} 摘 —— 调用方手写「摘三信号」的收尾会把双钩漏在进程上,而陈旧的那只
  *     rejection 钩仍握着 `process.exit(1)`,会对后续无关的 rejection 把进程打掉。
  */

package/dist/boot/shutdown.js

@@ -2,7 +2,8 @@ import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { writeCrashLast, clearCrashLast, readCrashLast } from "./crash-last.js";
 import { createSighupIdleHandler } from "../sighup-idle.js";
 import { createParentWatch } from "../parent-watch.js";
-import { reapHostForegroundChildren } from "../plugins/host-platform.js";
+import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
+import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
@@ -51,9 +52,45 @@ export function installShutdownHandlers(ctx) {
             logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
         }
     };
-    const onUncaughtException = (err) => {
+    const reapOwnHostWorkspaces = () => {
+        try {
+            const { removed, failed } = reapEphemeralHostWorkspaces();
+            if (removed.length > 0)
+                logger.info("shutdown_host_workspaces_reaped", { removed: removed.length });
+            if (failed.length > 0)
+                logger.warn("shutdown_host_workspace_reap_incomplete", { dirs: failed.map((f) => f.dir) });
+        }
+        catch (err) {
+            logger.warn("shutdown_host_workspace_reap_failed", { err: String(err) });
+        }
+    };
+    const onProcessExit = () => {
+        const onBooks = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
         try {
             reapOwnChildProcesses();
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_child_reap_threw", err);
+        }
+        try {
+            reapOwnHostWorkspaces();
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_workspace_reap_threw", err);
+        }
+        const left = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
+        try {
+            logger.info("shutdown_exit_boundary", { ...onBooks, leftForegroundChildren: left.foregroundChildren, leftHostWorkspaces: left.hostWorkspaces });
+            if (left.foregroundChildren > 0 || left.hostWorkspaces > 0)
+                logger.warn("shutdown_exit_boundary_incomplete", left);
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_log_threw", err);
+        }
+    };
+    process.once("exit", onProcessExit);
+    const onUncaughtException = (err) => {
+        try {
             writeLastWords(err);
             console.error(err);
         }
@@ -72,7 +109,6 @@ export function installShutdownHandlers(ctx) {
             return;
         }
         try {
-            reapOwnChildProcesses();
             writeLastWords(err);
             console.error(err);
         }
@@ -212,6 +248,7 @@ export function installShutdownHandlers(ctx) {
             if (disposed)
                 return;
             disposed = true;
+            process.removeListener("exit", onProcessExit);
             process.removeListener("uncaughtException", onUncaughtException);
             process.removeListener("unhandledRejection", onUnhandledRejection);
             process.removeListener("SIGTERM", drainThenShutdown);

package/dist/host-decision.d.ts

@@ -20,20 +20,41 @@ import { type ResumeOutcome } from "@sema-agent/core";
  *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
  *  · `decidedBy: "sla_timeout"` —— 宿主自己的 SLA 扫在行的 deadline 上判的(FACET A;**只有** sweep 能这么说,
  *    而 sweep 结构上不能 `allow`)。
+ *  · `decidedBy: "policy"`(core 7.26.2 / #1016)—— **这台部署自己的策略**拒的:答话的是机器不是人。调用方
+ *    经决裁体的 `settledBy` 自报;core 据它给模型铸一句**策略句**(而不是「用户不同意,停下来等他」),
+ *    并把结算记成 `policy_refused`(`who.party:"none"`)。`allow` 侧结构上不可(core pre-CAS 拒:只有人批准)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
-/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那两个词(第二铸点)。 */
+/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。 */
 export type HostDecision = Extract<ResumeOutcome, {
     gate: "policy_ask";
 }>["hostDecision"];
+/** **谁结束了这次等待**的闭集,型从 core 的那一格派生(本仓永不抄词表:core 加/退一个词,读它的每一处
+ *  编译期先红)。今天 = `"person"` | `"sla_timeout"` | `"policy"`。 */
+export type HostDecidedBy = HostDecision["decidedBy"];
 /**
- * 一次**人为** decide 的事实。`principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实
- * 没有名字可报)。
+ * 一次 decide 的事实,**一处成形**(两条 HTTP decide 腿 + 活卡 PARKED 赎回席共用)。
  *
- * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒
- * (`checkpoint.invalid_outcome`),而一个奇形怪状的 principal 把一次合法的人工决策变成 400 是纯回归。
- * 筛不过 ⇒ **不带这一格**(而不是带一个被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的
- * 名字既不是通道报的那个,也不是「通道没报」,两头都不真。
+ * `decidedBy` = 调用方**陈述**的决策者(缺席 ⇒ `"person"`,= 本面自古以来的形:一条不说话的 decide 就是
+ * 一个人按的)。🔴 **本仓零判据**:词表的属主是 core,不认识的词由它 pre-CAS 响亮拒
+ * (`checkpoint.invalid_outcome`,`hostDecision.decidedBy … is outside the closed set`)。在这里再判一次
+ * 就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第四个词就会被
+ * 静默 400 掉 —— 那正是 #1016 的 `"policy"` 加进来时本可以发生的事。
+ *
+ * `principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实没有名字可报)。
+ * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒,
+ * 而一个奇形怪状的 principal 把一次合法的决策变成 400 是纯回归。筛不过 ⇒ **不带这一格**(而不是带一个
+ * 被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的名字既不是通道报的那个,也不是
+ * 「通道没报」,两头都不真。
+ *
+ * 🔴 归属**不按词分岔**:core 的 `policy_refused` 结算记录上确实没有归属席(`who.party:"none"`),但那是
+ * **core 的记录**怎么写,不是**本服务观察到的事实**是什么 —— 送出这次请求的那把已验证身份是真的,本仓的
+ * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
+ *
+ * 🔴 **入参是 `string`,不是 `HostDecidedBy` —— 这一格刻意让类型说真话**(wire 边界强类型宪法):两条
+ * decide 腿能证得出的只有「调用方给了个串」(形门在各自的口上),**证不出**它是词表成员;把参数声明成
+ * 闭集就是让类型替一件本层从没做过的检查背书。⇒ 收 `string`,在**这一处**(本座的边界)做唯一一次 cast,
+ * 而那次 cast 说的是「我把一个未判词的串放到只收词的座上,判词的是座的属主(core,pre-CAS 响亮拒)」。
  */
-export declare function personDecision(principal: string | undefined): HostDecision;
+export declare function hostDecisionFacts(decidedBy: string | undefined, principal: string | undefined): HostDecision;
 //# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -1,6 +1,6 @@
 import { screenApproverAttribution } from "@sema-agent/core";
-export function personDecision(principal) {
+export function hostDecisionFacts(decidedBy, principal) {
     const screened = screenApproverAttribution(principal);
-    return { decidedBy: "person", ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+    return { decidedBy: (decidedBy ?? "person"), ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
 }
 //# sourceMappingURL=host-decision.js.map

package/dist/http/approval-sweeps.js

@@ -1,7 +1,7 @@
 import { redactHead } from "../observability/run-terminal.js";
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
-import { personDecision } from "../host-decision.js";
+import { hostDecisionFacts } from "../host-decision.js";
 import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
@@ -130,7 +130,7 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, personDecision(req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.settledBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     return { denyExpiredApprovals, redeemParkedAsk };

package/dist/http/resume-legs.js

@@ -62,6 +62,7 @@ const WORKER_SWAP_REDEEMABLE = {
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
 }
+const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(["hostDecision", "approver"]);
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
@@ -908,7 +909,9 @@ export function createResumeLegs(ctx) {
                         ...(taskId !== undefined ? { taskId } : {}),
                         error: e.message,
                         errorCode: e.code === "checkpoint.invalid_outcome"
-                            ? (outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid")
+                            ? (outcome.gate === "policy_ask" && !NON_BINDING_INVALID_OUTCOME_FIELDS.has(String(e.detail?.field ?? ""))
+                                ? "approval_binding_mismatch"
+                                : "resume_outcome_invalid")
                             : e.code,
                         ...(e.detail?.field ? { field: e.detail.field } : {}),
                         ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0

package/dist/http/routes/approvals-assistant.js

@@ -1,8 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
-import { personDecision } from "../../host-decision.js";
+import { hostDecisionFacts } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -21,10 +21,10 @@ import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "settledBy", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "settledBy", "updatedInput"];
 const ACCEPTED_DECIDE_BODY = new Set(DECIDE_BODY_DECLARED_KEYS);
 const UNSUPPORTED_DECIDE_BODY = new Set(["editedPlan", "sessionId", "taskId"]);
 export function decideBodyKeyIssue(raw) {
@@ -71,7 +71,8 @@ function buildApprovalEnvelope(sessionId, covered, reading) {
 }
 const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
 const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
-    "answer", "boundInputHash", "checkpointToken", "permissionMode", "remember", "sessionId", "taskId", "updatedInput",
+    ...DECIDE_BODY_DECLARED_KEYS.filter((k) => !PLAN_REVIEW_BODY_DECLARED_KEYS.includes(k)),
+    "permissionMode", "sessionId", "taskId",
 ]);
 export function planReviewBodyKeyIssue(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
@@ -553,7 +554,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, settledBy? }");
                 return;
             }
             {
@@ -624,6 +625,18 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
+            if (deps.config.directDoorActive && body.settledBy !== undefined) {
+                sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
+                return;
+            }
+            if (body.settledBy !== undefined && decision !== "deny") {
+                sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+                return;
+            }
+            if (body.settledBy !== undefined && typeof body.settledBy !== "string") {
+                sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -672,7 +685,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, personDecision(deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(body.settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
                 try {

package/dist/http/routes/memory-origin.d.ts

@@ -97,7 +97,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
         detail?: string | undefined;
         eventId: string;
         at: number;
-        to: "failed" | "done";
+        to: "done" | "failed";
         requestId: string;
     }[];
     custodyBytes: number;
@@ -105,7 +105,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "pending" | "failed" | "done";
+    status: "done" | "failed" | "pending";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;

package/dist/plugins/host-platform.d.ts

@@ -58,7 +58,11 @@ export declare function trackHostForegroundChild(pid: number): ForegroundChildTi
 /** 注销(`exit` / settle / 领养移交)。按回执身份删 ⇒ 幂等,且**绝不**碰同号的其它登记。 */
 export declare function untrackHostForegroundChild(ticket: ForegroundChildTicket): void;
 /** 一次前台收割的读数。三格分开是**刻意**的:`alreadyDead` 是想要的结果(不是失败),`failed` 是**真的**
- *  没收上来 —— 两者混成一个数就等于把后者静默掉([ref]:这条腿上不许有安静的兜底)。 */
+ *  没收上来 —— 两者混成一个数就等于把后者静默掉([ref]:这条腿上不许有安静的兜底)。
+ *
+ *  🔴 **三格只描述调用的那一拍**(S-557):`failed: []` 读作「这一拍发出去的信号没有被拒」,**不是**
+ *  「机器上一个都没落下」—— 簿在这一拍之后照样可以再登记(受控退的窗里在飞 turn 还在 spawn)。
+ *  「一个都没落下」这句话的承重点是退出边界那只钩,不是任何一次读数。 */
 export interface ForegroundReapReading {
     /** 真发出了杀伤信号的组数。 */
     readonly signalled: number;
@@ -71,9 +75,19 @@ export interface ForegroundReapReading {
  * 收割簿上全部前台子进程组。返回**发出**信号的读数,不是确认死亡数 —— 确认要等,而本函数的调用点之一
  * 是 uncaught 出口。
  *
- * **同步形、一次到位、不等宽限**:两个调用点(`hardShutdown` / uncaught 双钩)都紧挨着 `process.exit`,
- * `await` 一个宽限梯就是把收割赌在一个永远等不到的续段上。上界 = 簿上条数 × 一次 `kill(-pid)` syscall
- * (簿条数被 host lane 的在飞 turn 数界住),没有定时器、没有 promise。
+ * **同步形、一次到位、不等宽限**(S-557 起自述与实现同一句):承重的调用点是收尾链的
+ * `process.once("exit")` 钩 —— `exit` 之后**没有续段**,`await` 一个宽限梯就是把收割赌在一个永远等不到的
+ * 时刻上(`hardShutdown` 终点那次早按只是优化,见 `boot/shutdown.ts` 的两处注)。上界 = 簿上条数 ×
+ * 一次 `kill(-pid)` syscall(簿条数被 host lane 的在飞 turn 数界住),没有定时器、没有 promise。
+ *
+ * 🔴 **「没有定时器」只对 POSIX 成立**(codex 对抗复审 [high],亲读 core dist 验真后如实标注,**不在本仓绕**):
+ * win32 的 `killTreeHard` 落到 core 的 `signalProcessTree`,而它在**装了 Git Bash** 的机器上先 spawn 一只
+ * MSYS 组杀脚本(detached ⇒ 本进程退了它照跑),随后把 `taskkill /F /T` 的**兜底**排在一只 1200ms
+ * `setTimeout` 上 —— 那只定时器在退出边界这一拍跑不到。射程:MSYS 组杀抓不到的**原生**后代可能幸存;
+ * 没装 Git Bash 的机器走的是同步 spawn 的 `taskkill /F /T`,不吃这条。**属主在上游**(本仓只是调用方),
+ * 正解 = core 给一条**无定时器的同步硬收**面(与后台腿那条已登记的上游诉求同一族),下游自铸第二把
+ * win32 杀伤 = 同一语义面两个写者,禁。修前对照:崩溃双钩那两次收割紧挨 `exit(1)`,同样跑不到那只
+ * 定时器 ⇒ 这是**既有**暴露面,不是退出边界新开的洞;而受控退的早收割仍有十秒量级的窗,定时器跑得完。
  *
  * 🔴 **为什么是 `killTreeHard` 而不是 SIGTERM**(codex 对抗复审 [high],亲跑复现后改):软鞍的语义是
  * 「给它一个收尾窗,到点我再升级」,而这两个调用点之后**没有任何人在场**去升级 —— 一个
@@ -85,8 +99,9 @@ export interface ForegroundReapReading {
  * 真的成立。后台腿的宽限梯不受影响(那条腿有自己的属主,且不在本簿里)。
  */
 export declare function reapHostForegroundChildren(): ForegroundReapReading;
-/** 测试面:簿上现存条数(产品面没有消费者 —— 收割腿只读它自己那只 Set)。 */
-export declare function liveHostForegroundChildCountForTest(): number;
+/** 簿上现存条数。S-557 起**产品面也读它**(退出边界钩的「exit 时簿上还剩几条」哨兵),与第二本同形簿的
+ *  {@link liveEphemeralHostWorkspaceCount} 同名同形 —— 所以名字里不再带 `ForTest`(零别名,旧名直接消失)。 */
+export declare function liveHostForegroundChildCount(): number;
 /**
  * win32 env-key case collapse (design D1). Windows env keys are case-insensitive; Node hands the
  * object to CreateProcess as-is, so a case-sensitive merge that produced BOTH `Path` (inherited) and `PATH`

package/dist/plugins/host-platform.js

@@ -83,7 +83,7 @@ export function reapHostForegroundChildren() {
     liveHostForegroundGroups.clear();
     return { signalled, alreadyDead, failed };
 }
-export function liveHostForegroundChildCountForTest() {
+export function liveHostForegroundChildCount() {
     return liveHostForegroundGroups.size;
 }
 export function collapseWin32EnvKeys(env) {

package/dist/plugins/store-backend.js

@@ -8,6 +8,7 @@ import { FileOutcomeSink } from "./file-outcome-sink.js";
 import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
+import { buildStoreOpenRefusalTail } from "./store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
 import { NO_SQL_MIGRATIONS, runSqlOneTimeMigrations } from "./one-time-migrations.js";
 import { LocalSessionStore } from "./local-session-store.js";
@@ -234,8 +235,9 @@ class LocalBackend {
         catch (e) {
             if (e instanceof AdoptionError)
                 throw e;
-            throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)} ` +
-                "(another HTTP service / run-local instance may own it; stop it first or set LOCAL_DATA_ROOT to a free dir)");
+            const tail = buildStoreOpenRefusalTail(e, "http");
+            throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
+                (tail === undefined ? "" : ` ${tail}`));
         }
         this.sessionStore = new LocalSessionStore(new FileSessionRepo(this.fileBackend.root), this.fileBackend.root);
         this.runStore = new FileRunStore(this.fileBackend.root, {

package/dist/plugins/store-open-refusal.d.ts

@@ -0,0 +1,11 @@
+/** 取数据根的两条路。语义上只是「换根的通道叫什么」,不是两套出路。 */
+export type StoreOpenLane = "http" | "run-local";
+/**
+ * 数据根拒启句的**尾巴**:锁类失败 ⇒ 该码的出路;其余一切 ⇒ `undefined`(不加话)。
+ *
+ * @param err  构造 `FileStorageBackend` 时抛出来的东西(未经重铸 —— `store-lock-wait.ts` 的等待腿到窗
+ *             重抛时刻意保留 `code` 与类型身份,正是为了让这里分派得成)。
+ * @param lane 哪条路在问。只影响「换根」半句的措辞。
+ */
+export declare function buildStoreOpenRefusalTail(err: unknown, lane: StoreOpenLane): string | undefined;
+//# sourceMappingURL=store-open-refusal.d.ts.map

package/dist/plugins/store-open-refusal.js

@@ -0,0 +1,23 @@
+import { FileStoreLockError } from "@sema-agent/core";
+const FREE_ROOT_KNOB = {
+    http: "set LOCAL_DATA_ROOT to a free dir",
+    "run-local": "use a different --root",
+};
+export function buildStoreOpenRefusalTail(err, lane) {
+    if (!(err instanceof FileStoreLockError))
+        return undefined;
+    const code = err.code;
+    switch (code) {
+        case "store.dir_in_use":
+            return `(a LIVE process — possibly this one — owns this data dir; stop that process first, or ${FREE_ROOT_KNOB[lane]})`;
+        case "store.dir_claiming":
+            return "(transient: another process is taking over a crashed owner's lock — it either finishes or is itself reclaimed, so just retry in a moment)";
+        case "store.lock_unreadable":
+            return '(only a human can resolve this: do what the line above says, and nothing more — "unreadable" is NOT proof the owner is gone: a lock this process merely lacks permission to read looks identical, so confirm the holder is really stale (or fix the permission) before removing anything)';
+        default: {
+            const unhandled = code;
+            return `(unrecognized file-store lock code ${String(unhandled)}: this server build has no verified way out for it — treat the line above as the whole story)`;
+        }
+    }
+}
+//# sourceMappingURL=store-open-refusal.js.map

package/dist/run-local.js

@@ -7,7 +7,7 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
-import { Runner, uuidv7, parseModelMention, AdoptionError, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { hasOperatorGateIntent } from "./approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
@@ -17,6 +17,7 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
@@ -272,9 +273,9 @@ export async function runLocal(argv, deps = {}) {
     }
     catch (e) {
         printErr(`cannot open local data dir ${root}: ${e instanceof Error ? e.message : String(e)}`);
-        if (!(e instanceof AdoptionError)) {
-            printErr("(another run-local/engine instance may own it; finish it first, or use a different --root)");
-        }
+        const tail = buildStoreOpenRefusalTail(e, "run-local");
+        if (tail !== undefined)
+            printErr(tail);
         return 2;
     }
     const sessionStore = fileBackend.sessionStore;

package/dist/tool-approval.d.ts

@@ -1,3 +1,4 @@
+import type { HostDecidedBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
 import { type AskRequest, type AskOutcome, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
@@ -53,6 +54,13 @@ export interface ParkedAskRedeemRequest {
     decision: "approve" | "deny";
     /** [ref] 同源的人写理由(deny 时 core 把它交给模型;allow 只进审计面)。 */
     note?: string;
+    /** #1016:回决体自报的**结算来源**,原样过境到耐久腿的 `hostDecision.decidedBy`(缺席 ⇒ `"person"`)。
+     *  live 命中臂与本 PARKED 臂读**同一格** —— 同一份体落在哪条臂上只取决于副本与时序。
+     *  型 = `string`(本层证得出的全部);判词的是耐久座的属主 core,cast 在 `hostDecisionFacts` 那一处。
+     *  ⚠️ 两座的**词表并不相同**(live = `human`/`timeout`/`policy`,耐久 = `person`/`sla_timeout`/`policy`,
+     *  只在 `policy` 上相交)—— 这正是这条 wire 键只开 `"policy"` 一个词的原因,也是它不能声明成其中任何
+     *  一只闭集的原因:同一个串要落到两个不同词表的座上。 */
+    settledBy?: string;
     /** [ref] ctrl+g 编辑放行的实参整体替换(approve 才有意义)。 */
     updatedInput?: unknown;
     /** 发起本次 respond 的**已验证**调用方(live 腿 `gatedPrincipal` 的那一把)。席在赎回之前拿它与
@@ -575,6 +583,23 @@ export declare const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOffe
  * 指定 scope = 让一次「在项目 A 里点的同意」写成一条覆盖项目 B(或全局)的常驻放行 —— 那是这条轴上
  * 最贵的一次扩权。静默忽略同样不行:客户端会以为自己设上了。响亮拒,一句话说清谁拥有这一格。
  */
+/**
+ * #1016 —— `settledBy` 与 allow 族**互斥**的那一句(两条回决腿共用一份文本:同一个体在两条口上必须
+ * 拿到同一句话)。判的是**键在不在**,不是它是什么词。
+ */
+/**
+ * #1016 —— `settledBy` 的**形**拒句(两条回决腿共用一份文本,与 {@link SETTLED_BY_DENY_ONLY} 同姿势)。
+ *
+ * 🔴 **判形 ≠ 判词**:本层证得出的只有「它是个串」;「它是不是词表里的那个串」由**引擎**判(两条腿各有
+ * 一处响亮拒,读数在收车档)。加这道形门的理由是**类型必须说真话**(wire 边界强类型宪法):
+ * 一个非串值往下会落进 `AskOutcome.settledBy`(core 的串闭集)与本仓审计账本的 `settledBy?: string` 席 ——
+ * 两处都声明成串,而运行期塞进去一个数字。引擎对它照样响亮拒(实测三形一致:`"bogus"` / `1` / `null`
+ * 都是 `approver_contract` 的 fail-closed deny),所以这不是在补一个 fail-open,而是**不让本层的类型撒谎**;
+ * 顺带把「一个非串永远不可能是闭集成员」这件必然的事拒在最早的地方,与同一只 parser 里 `note` /
+ * `persistRule.rule` / `persistRule.edited` 三道既有形门**同族**(那三道在,只有本格没有 = 本格才是特例)。
+ */
+export declare const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string \u2014 the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
+export declare const SETTLED_BY_DENY_ONLY = "settledBy is only meaningful with decision \"deny\" \u2014 only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door's own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision";
 export declare const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope \u2014 the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 /** Validate the respond body — the closed three-choice enum (rationale in the module header). */
 export declare function parseToolApprovalResponse(body: unknown): {
@@ -583,10 +608,42 @@ export declare function parseToolApprovalResponse(body: unknown): {
     updatedInput?: unknown;
     persistRule?: ParsedPersistRule;
     note?: string;
+    settledBy?: string;
 } | {
     ok: false;
     error: string;
 };
+/**
+ * core 5.23.0([ref]/[ref]②)—— **宿主自报**的结算来源,`AskOutcome` 对象臂新开的口。本仓在这一格上有
+ * **两种身份**,合成一只座是刻意的(两只座 = 同一个 wire 位的两个写者):
+ *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
+ *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
+ *    永远被记成「一个人拒绝了」;
+ *  · **转**(调用方在回决体里自报的事实,core 7.26.2 / #1016 起):`settledBy:"policy"` = 答这张卡的是
+ *    **这台部署自己的策略**,不是人。本仓**零判据、原样过境**:词的拒绝逻辑归引擎(`resolveAsk` 对
+ *    自报词表外的值是响亮 fail-closed deny),本仓抄一份词表的那天 core 加词就会被静默 400 掉。
+ * 逐词(词表属主恒是 core):
+ *  · `"human"` —— 与「不铸这个键」逐字同义(core 缺席即按人处理);
+ *  · `"aborted"` —— core **明令拒收**宿主自报(那是引擎自家 fail-closed 端的词,宿主自报等于把自己的
+ *    拒绝改标成引擎故障),所以它**不在** `AskOutcome` 的这一格上,本型也就够不着它。
+ * 类型从 core 的**同步 outcome 面**推导(不手抄):`AskOutcome` 的对象臂上 `settledBy` 是**宿主报的事实**,
+ * core 7.6.0([ref] S6-A)删掉的是那张**结算词表**(`ApprovalSettledBy`),不是这一格 —— 词由 core 从
+ * 这个事实铸(`human_refused` / `approval_window_expired` / `policy_refused`)。core 若改这一格的词表,
+ * 这里编译期先红。
+ */
+type HostSettledBy = NonNullable<Extract<AskOutcome, {
+    allow: boolean;
+}>["settledBy"]>;
+/**
+ * #1016 —— wire 上**开给调用方**的那一个词,从 core 的两只闭集里取**交集**。
+ *
+ * 🔴 它是一条**文档钉**,不是过境值的型(过境值是 `string`,理由在 `parseToolApprovalResponse` 那处注):
+ * `"human"` 与缺席同义、`"timeout"` 是本仓自己观察到的窗(客户端说出来就是替服务端伪证一件只有服务端
+ * 看得见的事),而耐久座那边的 `"person"` / `"sla_timeout"` 同理。两只词表**只在 `"policy"` 上相交** ——
+ * 这条 wire 键因此恰好只开那一个词。core 哪天退役它,这里**编译期先红**,而不是在 wire 上静默留一个
+ * 两个座都已经不收的词;`test/tool-approval.test.ts` 的 #1016 那组按它写判据。
+ */
+export type RespondSettledBy = Extract<HostSettledBy, HostDecidedBy>;
 /**
  * [ref] R-13 C —— `UNATTENDED_APPROVAL_POLICY` 的**闭集**词表([ref]Q1「裁2:A+C」/[ref] 裁②)。
  *
@@ -1436,4 +1493,5 @@ export declare class ToolApprovalCoordinator {
     /** [ref]:当前在场的 park 墓碑数(有界性的可观测面 —— 判据据它证「帽是硬的、过期会被清」)。 */
     parkTombstoneCount(): number;
 }
+export {};
 //# sourceMappingURL=tool-approval.d.ts.map

package/dist/tool-approval.js

@@ -83,6 +83,8 @@ export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty str
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
+export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
+export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
@@ -127,12 +129,19 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
+        const rawSettledBy = body.settledBy;
+        if (rawSettledBy !== undefined && d !== "deny")
+            return { ok: false, error: SETTLED_BY_DENY_ONLY };
+        if (rawSettledBy !== undefined && typeof rawSettledBy !== "string")
+            return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
+        const settledBy = rawSettledBy;
         return {
             ok: true,
             value: d,
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
+            ...(rawSettledBy !== undefined ? { settledBy } : {}),
         };
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
@@ -1656,6 +1665,7 @@ export class ToolApprovalCoordinator {
                     gateBoundInputHash: row.gateBoundInputHash,
                     decision,
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
+                    ...(parsed.settledBy !== undefined ? { settledBy: parsed.settledBy } : {}),
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
@@ -1952,7 +1962,7 @@ export class ToolApprovalCoordinator {
             this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName)));
         }
         const allowed = parsed.value !== "deny";
-        entry.settle(allowed, allowed ? "allowed" : "denied", opts?.settlePayload !== undefined ? opts.settlePayload.updatedInput : parsed.updatedInput, undefined, allowed ? undefined : parsed.note);
+        entry.settle(allowed, allowed ? "allowed" : "denied", opts?.settlePayload !== undefined ? opts.settlePayload.updatedInput : parsed.updatedInput, parsed.settledBy, allowed ? undefined : parsed.note);
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;
         const noteRecorded = opts?.noteRecorded ?? false;
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.93.2",
+  "version": "7.93.3",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -59,7 +59,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.26.0",
+    "@sema-agent/core": "7.26.2",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",