@sema-agent/server 7.93.2 → 7.93.4

package/USAGE.md

@@ -375,12 +375,20 @@ MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheap
   core 5.54.0 起拒启错误带**可分派 code**(`FileStoreLockError`,message 点名占用方 pid),运维按码
   三动作:`store.dir_in_use`=另一个活进程持有该目录 → 停掉它(或换数据根/迁 SQL 后端);
   `store.dir_claiming`=另一进程正在接管崩溃者留下的锁 → **瞬态,稍候重试**(接管方要么完成要么
-  自己也被收割);`store.lock_unreadable`=锁文件坏形(无 owner 可解析/嵌套接管残留)→ 人工处置,
-  message 会点名要删的文件,**不要盲删数据根下其它东西**。server 刻意不把这族错**吞掉**(fail-fast:
+  自己也被收割);`store.lock_unreadable`=锁**读不出可解析的 owner**
+  (真坏形:无 owner / 嵌套接管残留;**或者**本进程读不动它 —— core 把一切非 ENOENT 的读失败都折进这一码)
+  → 人工处置,message 会点名要删的东西(⚠️ 三条消息点名的**不是同一个**:`LOCK` / `LOCK.claim.*` / 本进程
+  自己那把删不掉的锁),且 core 的句子**带条件** ——「stale 才删」:读不动的那一形背后可能是个**活**写者
+  (权限/属主不对),盲删 = 拆掉围栏 ⇒ 两个写者共用一个数据根。**不要盲删数据根下其它东西**。
+  server 刻意不把这族错**吞掉**(fail-fast:
   两进程共用 file 数据目录是禁止形,静默容忍比拒启更坏)。
+  ⚠️ **拒启句本身就带这三条里对应的那一条出路**(不必再回来查这张表);拒启原因**不是**锁冲突时
+  (磁盘满 / 权限 / 只读挂载 …)拒启句**不加任何出路猜测** —— 此前它一律拼「另一个实例可能占着,停掉它」,
+  把运维送去找一个不存在的进程。HTTP 服务与 `run-local` 共用同一只派生,只有「换一个空目录」那半句按通道
+  措辞不同(`LOCAL_DATA_ROOT` / `--root`)。
   ⚠️ 自 7.93.1 起 `store.dir_in_use` **这一码**多一道有界等待(见下面 `STORE_LOCK_WAIT_MS` 那条):
-  拒启形与文案一格不变,只是拒之前会先在窗内反复重取;另两码(`dir_claiming` / `lock_unreadable`)
-  与非锁类失败**一秒都不等**,原样抛。
+  **等待腿本身**不改拒启形、也不改上面那句出路(它只在拒之前先在窗内反复重取,并在拒句里多写一句
+  `waited Nms`);另两码(`dir_claiming` / `lock_unreadable`)与非锁类失败**一秒都不等**,原样抛。
   `DB_BACKEND=memory` 并非全无盘:workflow 相关账本仍挂数据根下——多个 memory 形引擎**不要共用**
   数据根/HOME(1.309 起并发 boot 不再拒启,但账本内容级共享仍不受支持)。
 - **`STORE_LOCK_WAIT_MS`(缺省 `60000`,单位 ms)—— 撞上活持锁人时等一会儿再拒**:

package/dist/adoption/wire.d.ts

@@ -28,8 +28,8 @@ export declare const AdoptionSourceSchema: z.ZodObject<{
 export type AdoptionSource = z.infer<typeof AdoptionSourceSchema>;
 /** per-store 腿的动作词(183 §6 闭集;form b 只会产出前两个 + `none`)。 */
 export declare const AdoptionLegActionSchema: z.ZodEnum<{
-    reset: "reset";
     none: "none";
+    reset: "reset";
     "bucket-rebind": "bucket-rebind";
     "row-rewrite": "row-rewrite";
     carried: "carried";
@@ -38,8 +38,8 @@ export type AdoptionLegAction = z.infer<typeof AdoptionLegActionSchema>;
 export declare const AdoptionLegSchema: z.ZodObject<{
     store: z.ZodString;
     action: z.ZodEnum<{
-        reset: "reset";
         none: "none";
+        reset: "reset";
         "bucket-rebind": "bucket-rebind";
         "row-rewrite": "row-rewrite";
         carried: "carried";
@@ -109,8 +109,8 @@ export declare const AdoptionReportSchema: z.ZodObject<{
     legs: z.ZodArray<z.ZodObject<{
         store: z.ZodString;
         action: z.ZodEnum<{
-            reset: "reset";
             none: "none";
+            reset: "reset";
             "bucket-rebind": "bucket-rebind";
             "row-rewrite": "row-rewrite";
             carried: "carried";
@@ -170,8 +170,8 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
         legs: z.ZodArray<z.ZodObject<{
             store: z.ZodString;
             action: z.ZodEnum<{
-                reset: "reset";
                 none: "none";
+                reset: "reset";
                 "bucket-rebind": "bucket-rebind";
                 "row-rewrite": "row-rewrite";
                 carried: "carried";
@@ -214,8 +214,8 @@ export type AdoptionReceipt = z.infer<typeof AdoptionReceiptSchema>;
 export declare const AdoptionLegsSchema: z.ZodArray<z.ZodObject<{
     store: z.ZodString;
     action: z.ZodEnum<{
-        reset: "reset";
         none: "none";
+        reset: "reset";
         "bucket-rebind": "bucket-rebind";
         "row-rewrite": "row-rewrite";
         carried: "carried";

package/dist/approval-ask-audit-store.js

@@ -7,6 +7,11 @@ export const CRASH_CONVERGED_LIST_MAX = 200;
 export function buildCheckpointAnchorHash(token) {
     return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 16);
 }
+const HOST_DECIDED_BY_WORDS = ["person", "sla_timeout", "policy"];
+const HOST_DECIDED_BY = new Set(HOST_DECIDED_BY_WORDS);
+function isHostDecidedBy(v) {
+    return typeof v === "string" && HOST_DECIDED_BY.has(v);
+}
 function readLedgerRecord(u) {
     if (u === null || typeof u !== "object" || Array.isArray(u))
         return undefined;
@@ -87,7 +92,7 @@ function readLedgerRecord(u) {
             const decidedByV = o.decidedBy;
             const legacySettledByV = decidedByV === undefined ? o.settledBy : undefined;
             const legacySettledBy = legacySettledByV === "human" || legacySettledByV === "timeout" || legacySettledByV === "aborted" ? legacySettledByV : undefined;
-            const decidedBy = decidedByV === "person" || decidedByV === "sla_timeout" ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
+            const decidedBy = isHostDecidedBy(decidedByV) ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
             const approver = s("approver");
             const settledAtMs = num("settledAtMs");
             const sessionId = s("sessionId");

package/dist/boot/shutdown.d.ts

@@ -12,7 +12,8 @@
  *     "第二个信号"的语义读数。
  *  3. `clearInterval(reaper)` 必须是 hardShutdown 的第一件事(在 `server.close()` 之前),否则
  *     收尾期还会有 reaper tick 打向正在关闭的池。
- *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的五只(三信号 + [ref]① 双钩)只能经返回的
+ *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的六只(三信号 + [ref]① 双钩 + S-557 退出边界钩)
+ *     只能经返回的
  *     {@link ShutdownHandle} 摘 —— 调用方手写「摘三信号」的收尾会把双钩漏在进程上,而陈旧的那只
  *     rejection 钩仍握着 `process.exit(1)`,会对后续无关的 rejection 把进程打掉。
  */

package/dist/boot/shutdown.js

@@ -2,7 +2,8 @@ import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { writeCrashLast, clearCrashLast, readCrashLast } from "./crash-last.js";
 import { createSighupIdleHandler } from "../sighup-idle.js";
 import { createParentWatch } from "../parent-watch.js";
-import { reapHostForegroundChildren } from "../plugins/host-platform.js";
+import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
+import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
@@ -51,9 +52,45 @@ export function installShutdownHandlers(ctx) {
             logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
         }
     };
-    const onUncaughtException = (err) => {
+    const reapOwnHostWorkspaces = () => {
+        try {
+            const { removed, failed } = reapEphemeralHostWorkspaces();
+            if (removed.length > 0)
+                logger.info("shutdown_host_workspaces_reaped", { removed: removed.length });
+            if (failed.length > 0)
+                logger.warn("shutdown_host_workspace_reap_incomplete", { dirs: failed.map((f) => f.dir) });
+        }
+        catch (err) {
+            logger.warn("shutdown_host_workspace_reap_failed", { err: String(err) });
+        }
+    };
+    const onProcessExit = () => {
+        const onBooks = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
         try {
             reapOwnChildProcesses();
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_child_reap_threw", err);
+        }
+        try {
+            reapOwnHostWorkspaces();
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_workspace_reap_threw", err);
+        }
+        const left = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
+        try {
+            logger.info("shutdown_exit_boundary", { ...onBooks, leftForegroundChildren: left.foregroundChildren, leftHostWorkspaces: left.hostWorkspaces });
+            if (left.foregroundChildren > 0 || left.hostWorkspaces > 0)
+                logger.warn("shutdown_exit_boundary_incomplete", left);
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_log_threw", err);
+        }
+    };
+    process.once("exit", onProcessExit);
+    const onUncaughtException = (err) => {
+        try {
             writeLastWords(err);
             console.error(err);
         }
@@ -72,7 +109,6 @@ export function installShutdownHandlers(ctx) {
             return;
         }
         try {
-            reapOwnChildProcesses();
             writeLastWords(err);
             console.error(err);
         }
@@ -212,6 +248,7 @@ export function installShutdownHandlers(ctx) {
             if (disposed)
                 return;
             disposed = true;
+            process.removeListener("exit", onProcessExit);
             process.removeListener("uncaughtException", onUncaughtException);
             process.removeListener("unhandledRejection", onUnhandledRejection);
             process.removeListener("SIGTERM", drainThenShutdown);

package/dist/host-decision.d.ts

@@ -14,26 +14,74 @@
  * ⇒ 本仓的规则从「记住一张词×决定的相容表」变成「说出你知道的那两件事」。相容性也不再靠记忆:一次
  * sweep 不可能 `allow`,core pre-CAS 拒。
  */
-import { type ResumeOutcome } from "@sema-agent/core";
+import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
 /**
  * 谁结束了这次等待,以及通道自报的归属。
  *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
  *  · `decidedBy: "sla_timeout"` —— 宿主自己的 SLA 扫在行的 deadline 上判的(FACET A;**只有** sweep 能这么说,
  *    而 sweep 结构上不能 `allow`)。
+ *  · `decidedBy: "policy"`(core 7.26.2 / #1016)—— **这台部署自己的策略**拒的:答话的是机器不是人。调用方
+ *    经决裁体的 `settledBy` 自报;core 据它给模型铸一句**策略句**(而不是「用户不同意,停下来等他」),
+ *    并把结算记成 `policy_refused`(`who.party:"none"`)。`allow` 侧结构上不可(core pre-CAS 拒:只有人批准)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
-/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那两个词(第二铸点)。 */
+/**
+ * core 5.23.0([ref]/[ref]②)—— **宿主自报**的结算来源,`AskOutcome` 对象臂那一格的型。本仓在这一格上有
+ * **两种身份**,合成一只座是刻意的(两只座 = 同一个 wire 位的两个写者):
+ *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
+ *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
+ *    永远被记成「一个人拒绝了」;
+ *  · **转**(调用方在回决体里自报的事实,core 7.26.2 / #1016 起):`settledBy:"policy"` = 答这张卡的是
+ *    **这台部署自己的策略**,不是人。本仓**零判据、原样过境**:词的拒绝逻辑归引擎(`resolveAsk` 对
+ *    自报词表外的值是响亮 fail-closed deny),本仓抄一份词表的那天 core 加词就会被静默 400 掉。
+ * 逐词(词表属主恒是 core):
+ *  · `"human"` —— 与「不铸这个键」逐字同义(core 缺席即按人处理);
+ *  · `"aborted"` —— core **明令拒收**宿主自报(那是引擎自家 fail-closed 端的词,宿主自报等于把自己的
+ *    拒绝改标成引擎故障),所以它**不在** `AskOutcome` 的这一格上,本型也就够不着它。
+ * 类型从 core 的**同步 outcome 面**推导(不手抄):`AskOutcome` 的对象臂上 `settledBy` 是**宿主报的事实**,
+ * core 7.6.0([ref] S6-A)删掉的是那张**结算词表**(`ApprovalSettledBy`),不是这一格 —— 词由 core 从
+ * 这个事实铸(`human_refused` / `approval_window_expired` / `policy_refused`)。core 若改这一格的词表,
+ * 读它的每一处编译期先红。
+ *
+ * 🔴 **S-558:为什么这一格住在本叶子模块**(此前是 `tool-approval.ts` 的模块私有型):来源位随决议
+ * **落持久行**之后,店(`src/plugins/approval-ask-store-sql.ts` 的 `AskRow.settledBy` /
+ * `DecideAskInput.settledBy`)与协调器都要说同一个型 —— 而店不能反向依赖协调器。本模块只依赖
+ * `@sema-agent/core`,与同住的 {@link HostDecidedBy}(耐久腿的同位事实)恰好是一对:一条决议的来源
+ * 在两条腿上是同一件事,型也该在同一处。
+ */
+export type HostSettledBy = NonNullable<Extract<AskOutcome, {
+    allow: boolean;
+}>["settledBy"]>;
+/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。 */
 export type HostDecision = Extract<ResumeOutcome, {
     gate: "policy_ask";
 }>["hostDecision"];
+/** **谁结束了这次等待**的闭集,型从 core 的那一格派生(本仓永不抄词表:core 加/退一个词,读它的每一处
+ *  编译期先红)。今天 = `"person"` | `"sla_timeout"` | `"policy"`。 */
+export type HostDecidedBy = HostDecision["decidedBy"];
 /**
- * 一次**人为** decide 的事实。`principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实
- * 没有名字可报)。
+ * 一次 decide 的事实,**一处成形**(两条 HTTP decide 腿 + 活卡 PARKED 赎回席共用)。
+ *
+ * `decidedBy` = 调用方**陈述**的决策者(缺席 ⇒ `"person"`,= 本面自古以来的形:一条不说话的 decide 就是
+ * 一个人按的)。🔴 **本仓零判据**:词表的属主是 core,不认识的词由它 pre-CAS 响亮拒
+ * (`checkpoint.invalid_outcome`,`hostDecision.decidedBy … is outside the closed set`)。在这里再判一次
+ * 就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第四个词就会被
+ * 静默 400 掉 —— 那正是 #1016 的 `"policy"` 加进来时本可以发生的事。
+ *
+ * `principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实没有名字可报)。
+ * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒,
+ * 而一个奇形怪状的 principal 把一次合法的决策变成 400 是纯回归。筛不过 ⇒ **不带这一格**(而不是带一个
+ * 被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的名字既不是通道报的那个,也不是
+ * 「通道没报」,两头都不真。
+ *
+ * 🔴 归属**不按词分岔**:core 的 `policy_refused` 结算记录上确实没有归属席(`who.party:"none"`),但那是
+ * **core 的记录**怎么写,不是**本服务观察到的事实**是什么 —— 送出这次请求的那把已验证身份是真的,本仓的
+ * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
  *
- * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒
- * (`checkpoint.invalid_outcome`),而一个奇形怪状的 principal 把一次合法的人工决策变成 400 是纯回归。
- * 筛不过 ⇒ **不带这一格**(而不是带一个被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的
- * 名字既不是通道报的那个,也不是「通道没报」,两头都不真。
+ * 🔴 **入参是 `string`,不是 `HostDecidedBy` —— 这一格刻意让类型说真话**(wire 边界强类型宪法):两条
+ * decide 腿能证得出的只有「调用方给了个串」(形门在各自的口上),**证不出**它是词表成员;把参数声明成
+ * 闭集就是让类型替一件本层从没做过的检查背书。⇒ 收 `string`,在**这一处**(本座的边界)做唯一一次 cast,
+ * 而那次 cast 说的是「我把一个未判词的串放到只收词的座上,判词的是座的属主(core,pre-CAS 响亮拒)」。
  */
-export declare function personDecision(principal: string | undefined): HostDecision;
+export declare function hostDecisionFacts(decidedBy: string | undefined, principal: string | undefined): HostDecision;
 //# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -1,6 +1,6 @@
 import { screenApproverAttribution } from "@sema-agent/core";
-export function personDecision(principal) {
+export function hostDecisionFacts(decidedBy, principal) {
     const screened = screenApproverAttribution(principal);
-    return { decidedBy: "person", ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+    return { decidedBy: (decidedBy ?? "person"), ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
 }
 //# sourceMappingURL=host-decision.js.map

package/dist/http/approval-sweeps.js

@@ -1,7 +1,7 @@
 import { redactHead } from "../observability/run-terminal.js";
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
-import { personDecision } from "../host-decision.js";
+import { hostDecisionFacts } from "../host-decision.js";
 import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
@@ -130,7 +130,7 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, personDecision(req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.settledBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     return { denyExpiredApprovals, redeemParkedAsk };

package/dist/http/resume-legs.js

@@ -62,6 +62,7 @@ const WORKER_SWAP_REDEEMABLE = {
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
 }
+const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(["hostDecision", "approver"]);
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
@@ -908,7 +909,9 @@ export function createResumeLegs(ctx) {
                         ...(taskId !== undefined ? { taskId } : {}),
                         error: e.message,
                         errorCode: e.code === "checkpoint.invalid_outcome"
-                            ? (outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid")
+                            ? (outcome.gate === "policy_ask" && !NON_BINDING_INVALID_OUTCOME_FIELDS.has(String(e.detail?.field ?? ""))
+                                ? "approval_binding_mismatch"
+                                : "resume_outcome_invalid")
                             : e.code,
                         ...(e.detail?.field ? { field: e.detail.field } : {}),
                         ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0

package/dist/http/routes/approvals-assistant.js

@@ -1,8 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
-import { personDecision } from "../../host-decision.js";
+import { hostDecisionFacts } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -21,10 +21,10 @@ import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "settledBy", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "settledBy", "updatedInput"];
 const ACCEPTED_DECIDE_BODY = new Set(DECIDE_BODY_DECLARED_KEYS);
 const UNSUPPORTED_DECIDE_BODY = new Set(["editedPlan", "sessionId", "taskId"]);
 export function decideBodyKeyIssue(raw) {
@@ -71,7 +71,8 @@ function buildApprovalEnvelope(sessionId, covered, reading) {
 }
 const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
 const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
-    "answer", "boundInputHash", "checkpointToken", "permissionMode", "remember", "sessionId", "taskId", "updatedInput",
+    ...DECIDE_BODY_DECLARED_KEYS.filter((k) => !PLAN_REVIEW_BODY_DECLARED_KEYS.includes(k)),
+    "permissionMode", "sessionId", "taskId",
 ]);
 export function planReviewBodyKeyIssue(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
@@ -553,7 +554,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, settledBy? }");
                 return;
             }
             {
@@ -624,6 +625,18 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
+            if (deps.config.directDoorActive && body.settledBy !== undefined) {
+                sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
+                return;
+            }
+            if (body.settledBy !== undefined && decision !== "deny") {
+                sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+                return;
+            }
+            if (body.settledBy !== undefined && typeof body.settledBy !== "string") {
+                sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -672,7 +685,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, personDecision(deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(body.settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
                 try {

package/dist/http/routes/memory-origin.d.ts

@@ -97,7 +97,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
         detail?: string | undefined;
         eventId: string;
         at: number;
-        to: "failed" | "done";
+        to: "done" | "failed";
         requestId: string;
     }[];
     custodyBytes: number;
@@ -105,7 +105,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "pending" | "failed" | "done";
+    status: "done" | "failed" | "pending";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;

package/dist/http/routes/runs.js

@@ -16,7 +16,7 @@ import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
-import { ASK_DECISION_CONSUMER_ABSENT, resolveStreamApprovalGate } from "../../tool-approval.js";
+import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
@@ -1321,7 +1321,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 return true;
             if (deps.toolApproval?.editedDecisionInFlight(row.askId) === true)
                 return true;
-            const settled = deps.toolApproval?.notifyExternalDecision(row.askId, row.decision === "approve", row.updatedInput);
+            const settled = deps.toolApproval?.notifyExternalDecision(row.askId, outcomeOfDecidedRow(row));
             observedSettled.set(row.askId, settled?.settled ?? 0);
             return true;
         };
@@ -1431,7 +1431,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                         confirmed.decision === body.decision &&
                         confirmed.idempotencyKey === body.idempotencyKey &&
                         !confirmed.provisional) {
-                        const settledNow = deps.toolApproval.notifyExternalDecision(askId, confirmed.decision === "approve", confirmed.updatedInput).settled;
+                        const settledNow = deps.toolApproval.notifyExternalDecision(askId, outcomeOfDecidedRow(confirmed)).settled;
                         deps.logger?.warn?.("ask_decision_edit_settled_after_ambiguous_commit", { taskId, askId, settled: settledNow });
                     }
                 }
@@ -1470,11 +1470,11 @@ export async function handleRunVerbs(req, res, match, ctx) {
             return;
         if (outcome.row.decision !== body.decision) {
             deps.logger?.error?.("ask_decision_row_diverged", { taskId, askId, requested: body.decision, stored: outcome.row.decision });
-            deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcome.row.decision === "approve", outcome.row.updatedInput);
+            deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcomeOfDecidedRow(outcome.row));
             sendError(res, 500, "internal.error", "the ask row was rewritten between commit and read-back — the decision that stands is not the one this request submitted; re-read the ask before acting on it");
             return;
         }
-        const settled = deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcome.row.decision === "approve", outcome.row.updatedInput).settled ?? 0;
+        const settled = deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcomeOfDecidedRow(outcome.row)).settled ?? 0;
         const forwarded = outcome.row.decision === "approve" && outcome.row.updatedInput !== undefined && settled > 0;
         sendJson(res, 200, {
             askId: outcome.row.askId,

package/dist/plugins/approval-ask-store-memory.js

@@ -1,5 +1,5 @@
 import { canAskTransition } from "../approval-ask-machine.js";
-import { assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
+import { assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
     if (patch.decision !== undefined)
         row.decision = patch.decision;
@@ -42,7 +42,7 @@ export class InMemoryApprovalAskStore {
     }
     importRows(snapshot) {
         for (const r of snapshot.asks ?? [])
-            this.asks.set(r.askId, { ...r });
+            this.asks.set(r.askId, { ...r, settledBy: r.settledBy ?? null });
         for (const b of snapshot.batches ?? [])
             this.batches.set(b.batchId, { ...b });
     }
@@ -80,6 +80,7 @@ export class InMemoryApprovalAskStore {
             decision: null,
             decisionActor: null,
             decisionNote: null,
+            settledBy: null,
             decidedAtMs: null,
             deniedReason: null,
             gateToken: null,
@@ -113,6 +114,7 @@ export class InMemoryApprovalAskStore {
     async decideAsk(askId, batchId, decision) {
         if (decision.idempotencyKey != null)
             assertIdempotencyKeyShape(decision.idempotencyKey);
+        assertDecideSettledBy(decision);
         const now = this.now();
         const batch = this.batches.get(batchId);
         if (!batch || batch.state !== "OPEN") {
@@ -139,6 +141,7 @@ export class InMemoryApprovalAskStore {
         ask.decision = decision.decision;
         ask.decisionActor = decision.decisionActor ?? null;
         ask.decisionNote = decision.decisionNote ?? null;
+        ask.settledBy = decision.settledBy ?? null;
         if (decision.updatedInput === undefined)
             delete ask.updatedInput;
         else

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -41,6 +41,7 @@ import type { Pool as PgPool } from "pg";
 import type { PgQueryFn } from "./pg-query.js";
 import { type SqlDriver, type SqlDialect } from "./sql-driver.js";
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
+import type { HostSettledBy } from "../host-decision.js";
 import { type IndexSpec } from "./ensure-index.js";
 export type AskDecision = "approve" | "deny";
 export interface AskRow {
@@ -79,6 +80,32 @@ export interface AskRow {
     /** 171 ActorAssertion JSON(车4 才消费,列先在——JSON.parse 后的裸值,类型未知)。 */
     decisionActor: unknown | null;
     decisionNote: string | null;
+    /**
+     * 🔴 S-558(#1016 的持久半场)—— 这条决议的**结算来源**:`null` = 一个人答的(= 缺席律,core 对
+     * 不带这一格的 outcome 逐字按 `"human"` 读),非 null = 宿主自报的那个词(今天 wire 上只开
+     * `"policy"`,词表属主恒是 core —— 见 {@link HostSettledBy})。
+     *
+     * **为什么必须是行上的一格**(病灶,7.93.3 合并树 codex ① 验真):`settledBy` 此前只到达**当次**回决的
+     * 即时回调,行上不留痕 ⇒ 重放 / 再入 / 同 askId 的兄弟等待者 / 歧义提交恢复读回的是裸 `false`,
+     * 而裸 `false` 在 core 那边逐字是「**一个人**拒绝了」—— 模型于是又读到那句「用户不想继续,停下来等他」,
+     * 在一条根本没有人的 run 里。不变量:**一条决议的来源在所有读回路径上是同一个事实**;唯一读回铸点 =
+     * `tool-approval.ts` 的 `outcomeOfDecidedRow`。
+     *
+     * 🔴 **为什么是自己一列,不是塞进 `decision_actor` 那只袋**(S-558 取舍,亲读后定):
+     *  · 那只袋是**自由载荷**——型是 `unknown`(见上一格),读回不过任何 schema(`parseJsonColumn` 返回
+     *    `unknown`),schema 属主在别处([ref] ActorAssertion),`adoption/plan.ts` 的裁定 D2 把它连同
+     *    `decision_note` 一起定为**史实字段,永不改写**。往一只没有属主、没有类型化读回的袋里塞一个
+     *    **执行面**的判别位 = 让一格决定「工具跑不跑、模型读哪一句」的事实寄生在一个只做审计的载荷上。
+     *  · 更硬的一条:**live 回决腿根本不写那只袋**(`respondWithCas` 的 `decideAsk` 入参里没有
+     *    `decisionActor`,列恒 NULL)。来源位进袋 ⇒ 那条腿得为了捎一个词现铸一只它压根没有的 actor
+     *    ——凭空发明「谁按的」,正是 `hostDecisionFacts` 顶注禁的那件事。
+     *  · 一列的代价已经由本仓的 SCHEMA POLICY 定死且**与既有两批加列同形**([ref] 两列、[ref] 一列):
+     *    改 CREATE + 启动期响亮拒(见 {@link assertApprovalAskRuleMaterialSchema}),零 ALTER、零双读、
+     *    老行 NULL 恒读成「人决」。
+     *
+     * 三态收成两态是刻意的:`"human"` 与缺席在 core 那边逐字同义,故店只存「非人」的那些词,`null` 即人。
+     */
+    settledBy: HostSettledBy | null;
     /**
      * [ref]([ref] / [ref] 收口):人批准时带的 **ctrl+g 编辑实参**(wire `updatedInput`),与决议**同一条
      * UPDATE** 原子落列 `updated_input`。语义三态,读法**严格**:
@@ -199,6 +226,14 @@ export interface DecideAskInput {
     decisionNote?: string | null;
     /** 车4 §12-E:回决幂等键,赢 CAS 时随决议一起落列(见 `AskRow.idempotencyKey`)。缺席 ⇒ 列保持 NULL。 */
     idempotencyKey?: string | null;
+    /**
+     * 🔴 S-558:本次回决的**结算来源**,与决议同一条 UPDATE 落列 `settled_by`(语义/两态读法/为什么是
+     * 自己一列,全在 {@link AskRow.settledBy})。缺席 ⇒ 列 NULL ⇒ 读回是「一个人答的」。
+     *
+     * 店**不判词**(词表属主是 core):写什么存什么。店只判**形** —— `assertDecideSettledBy` 的两条
+     * (长度 ≤ 列宽、只与 `deny` 同行),理由见那只门的顶注;三 twin 同判。
+     */
+    settledBy?: HostSettledBy;
     /** [ref]:ctrl+g 编辑实参,与决议同一条 UPDATE 落列(语义三态见 {@link AskRow.updatedInput})。
      *  缺席 / `undefined` ⇒ 列 NULL(没带编辑);**`null` 是值**(编辑成 null),照存 JSON `"null"`。
      *  调用方纪律:deny 不传(店不替调用方判决议方向,写什么存什么)。 */
@@ -233,6 +268,24 @@ export type DecideResult = {
  *  的 deadline 铸点)负责给整数,本守卫只拦漏网。 */
 export declare function assertIntegralEpochMs(field: string, value: number): void;
 export declare function assertIdempotencyKeyShape(key: string): void;
+/** `settled_by` 列宽 = 这一格的唯一尺(两方言 DDL 与下面的形门读同一个常量,不手抄第二份)。 */
+export declare const MAX_SETTLED_BY_CHARS = 16;
+/**
+ * S-558 的**入店卫生门**(三 twin 同判,与 {@link assertIdempotencyKeyShape} / {@link assertIntegralEpochMs} 同族)。
+ * 判的是**形**,不是**词** —— 词表属主恒是 core(`resolveAsk` 对自报词表外的值是响亮 fail-closed deny),
+ * 本层一个词都不认识。两条:
+ *
+ * ① **长度 ≤ 列宽**。`settled_by` 是 `VARCHAR(16)` 的闭集词列,而值来自 wire(两条回决腿只证得出「它是个串」)。
+ *    不拦的话:MySQL 协议侧非严格模式**静默截断**、PG 侧直接报错 —— 同一份调用方代码在两个后端拿到两种
+ *    答案(`assertIdempotencyKeyShape` 的 PAD SPACE 论证逐字同源),而**被截断过的词与原词是两个词**:
+ *    一条决议的来源在库里变成了另一件事。空串同拒(core 那边它不是词,存进去只会读成一个假的「非人」)。
+ * ② **只与 `deny` 同行**。core 的契约明写两个非人词只在 `allow:false` 上合法(`{allow:true,settledBy}` 是
+ *    fail-closed 拒),两条回决腿也都在**裁决之前**照此响亮拒(`tool-approval.ts` 的
+ *    `SETTLED_BY_DENY_ONLY`,两腿共用一份文案)。在店门口再执行一次不是「第二个判官」:判的不是词而是**这一对列能不能共存**。
+ *    收益是结构性的 —— 「approve 行带来源位」从此在写面不可表示,读回铸点(`outcomeOfDecidedRow`)的 allow 臂
+ *    因此**证得出**不会丢掉任何真事实,而不是靠记性。
+ */
+export declare function assertDecideSettledBy(decision: Pick<DecideAskInput, "decision" | "settledBy">): void;
 /**
  * [ref] 车3 刀 3b(§14.2 遗留记账):两条**重放读口**被调用方的 deadline 掐断时抛的具名错误。
  *
@@ -277,6 +330,9 @@ export type AskTerminalClaimCurrent = {
     decision: AskDecision | null;
     /** [ref] 三态读法照 {@link AskRow.updatedInput}:键缺席 = 没带编辑;`null` 是编辑成 null 的值。 */
     updatedInput?: unknown;
+    /** S-558:赢家决议的**结算来源**(语义与两态读法见 {@link AskRow.settledBy})。**必填**(不是可选)——
+     *  可选会让投影漏挑这一列时静默编译过,而漏挑的后果恰是本批要修的病:CAS 输家把赢家的策略拒读成人拒。 */
+    settledBy: HostSettledBy | null;
 };
 /**
  * 单次原子往返的答案(语义律的唯一规范陈述点 = core `checkpoint-store.ts` `claimTerminal` 契约 JSDoc,