@sema-agent/server 7.93.3 → 7.93.4

package/dist/host-decision.d.ts

@@ -14,7 +14,7 @@
  * ⇒ 本仓的规则从「记住一张词×决定的相容表」变成「说出你知道的那两件事」。相容性也不再靠记忆:一次
  * sweep 不可能 `allow`,core pre-CAS 拒。
  */
-import { type ResumeOutcome } from "@sema-agent/core";
+import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
 /**
  * 谁结束了这次等待,以及通道自报的归属。
  *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
@@ -25,6 +25,33 @@ import { type ResumeOutcome } from "@sema-agent/core";
  *    并把结算记成 `policy_refused`(`who.party:"none"`)。`allow` 侧结构上不可(core pre-CAS 拒:只有人批准)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
+/**
+ * core 5.23.0([ref]/[ref]②)—— **宿主自报**的结算来源,`AskOutcome` 对象臂那一格的型。本仓在这一格上有
+ * **两种身份**,合成一只座是刻意的(两只座 = 同一个 wire 位的两个写者):
+ *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
+ *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
+ *    永远被记成「一个人拒绝了」;
+ *  · **转**(调用方在回决体里自报的事实,core 7.26.2 / #1016 起):`settledBy:"policy"` = 答这张卡的是
+ *    **这台部署自己的策略**,不是人。本仓**零判据、原样过境**:词的拒绝逻辑归引擎(`resolveAsk` 对
+ *    自报词表外的值是响亮 fail-closed deny),本仓抄一份词表的那天 core 加词就会被静默 400 掉。
+ * 逐词(词表属主恒是 core):
+ *  · `"human"` —— 与「不铸这个键」逐字同义(core 缺席即按人处理);
+ *  · `"aborted"` —— core **明令拒收**宿主自报(那是引擎自家 fail-closed 端的词,宿主自报等于把自己的
+ *    拒绝改标成引擎故障),所以它**不在** `AskOutcome` 的这一格上,本型也就够不着它。
+ * 类型从 core 的**同步 outcome 面**推导(不手抄):`AskOutcome` 的对象臂上 `settledBy` 是**宿主报的事实**,
+ * core 7.6.0([ref] S6-A)删掉的是那张**结算词表**(`ApprovalSettledBy`),不是这一格 —— 词由 core 从
+ * 这个事实铸(`human_refused` / `approval_window_expired` / `policy_refused`)。core 若改这一格的词表,
+ * 读它的每一处编译期先红。
+ *
+ * 🔴 **S-558:为什么这一格住在本叶子模块**(此前是 `tool-approval.ts` 的模块私有型):来源位随决议
+ * **落持久行**之后,店(`src/plugins/approval-ask-store-sql.ts` 的 `AskRow.settledBy` /
+ * `DecideAskInput.settledBy`)与协调器都要说同一个型 —— 而店不能反向依赖协调器。本模块只依赖
+ * `@sema-agent/core`,与同住的 {@link HostDecidedBy}(耐久腿的同位事实)恰好是一对:一条决议的来源
+ * 在两条腿上是同一件事,型也该在同一处。
+ */
+export type HostSettledBy = NonNullable<Extract<AskOutcome, {
+    allow: boolean;
+}>["settledBy"]>;
 /** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。 */
 export type HostDecision = Extract<ResumeOutcome, {
     gate: "policy_ask";

package/dist/http/routes/runs.js

@@ -16,7 +16,7 @@ import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
-import { ASK_DECISION_CONSUMER_ABSENT, resolveStreamApprovalGate } from "../../tool-approval.js";
+import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
@@ -1321,7 +1321,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 return true;
             if (deps.toolApproval?.editedDecisionInFlight(row.askId) === true)
                 return true;
-            const settled = deps.toolApproval?.notifyExternalDecision(row.askId, row.decision === "approve", row.updatedInput);
+            const settled = deps.toolApproval?.notifyExternalDecision(row.askId, outcomeOfDecidedRow(row));
             observedSettled.set(row.askId, settled?.settled ?? 0);
             return true;
         };
@@ -1431,7 +1431,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                         confirmed.decision === body.decision &&
                         confirmed.idempotencyKey === body.idempotencyKey &&
                         !confirmed.provisional) {
-                        const settledNow = deps.toolApproval.notifyExternalDecision(askId, confirmed.decision === "approve", confirmed.updatedInput).settled;
+                        const settledNow = deps.toolApproval.notifyExternalDecision(askId, outcomeOfDecidedRow(confirmed)).settled;
                         deps.logger?.warn?.("ask_decision_edit_settled_after_ambiguous_commit", { taskId, askId, settled: settledNow });
                     }
                 }
@@ -1470,11 +1470,11 @@ export async function handleRunVerbs(req, res, match, ctx) {
             return;
         if (outcome.row.decision !== body.decision) {
             deps.logger?.error?.("ask_decision_row_diverged", { taskId, askId, requested: body.decision, stored: outcome.row.decision });
-            deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcome.row.decision === "approve", outcome.row.updatedInput);
+            deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcomeOfDecidedRow(outcome.row));
             sendError(res, 500, "internal.error", "the ask row was rewritten between commit and read-back — the decision that stands is not the one this request submitted; re-read the ask before acting on it");
             return;
         }
-        const settled = deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcome.row.decision === "approve", outcome.row.updatedInput).settled ?? 0;
+        const settled = deps.toolApproval?.notifyExternalDecision(outcome.row.askId, outcomeOfDecidedRow(outcome.row)).settled ?? 0;
         const forwarded = outcome.row.decision === "approve" && outcome.row.updatedInput !== undefined && settled > 0;
         sendJson(res, 200, {
             askId: outcome.row.askId,

package/dist/plugins/approval-ask-store-memory.js

@@ -1,5 +1,5 @@
 import { canAskTransition } from "../approval-ask-machine.js";
-import { assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
+import { assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
     if (patch.decision !== undefined)
         row.decision = patch.decision;
@@ -42,7 +42,7 @@ export class InMemoryApprovalAskStore {
     }
     importRows(snapshot) {
         for (const r of snapshot.asks ?? [])
-            this.asks.set(r.askId, { ...r });
+            this.asks.set(r.askId, { ...r, settledBy: r.settledBy ?? null });
         for (const b of snapshot.batches ?? [])
             this.batches.set(b.batchId, { ...b });
     }
@@ -80,6 +80,7 @@ export class InMemoryApprovalAskStore {
             decision: null,
             decisionActor: null,
             decisionNote: null,
+            settledBy: null,
             decidedAtMs: null,
             deniedReason: null,
             gateToken: null,
@@ -113,6 +114,7 @@ export class InMemoryApprovalAskStore {
     async decideAsk(askId, batchId, decision) {
         if (decision.idempotencyKey != null)
             assertIdempotencyKeyShape(decision.idempotencyKey);
+        assertDecideSettledBy(decision);
         const now = this.now();
         const batch = this.batches.get(batchId);
         if (!batch || batch.state !== "OPEN") {
@@ -139,6 +141,7 @@ export class InMemoryApprovalAskStore {
         ask.decision = decision.decision;
         ask.decisionActor = decision.decisionActor ?? null;
         ask.decisionNote = decision.decisionNote ?? null;
+        ask.settledBy = decision.settledBy ?? null;
         if (decision.updatedInput === undefined)
             delete ask.updatedInput;
         else

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -41,6 +41,7 @@ import type { Pool as PgPool } from "pg";
 import type { PgQueryFn } from "./pg-query.js";
 import { type SqlDriver, type SqlDialect } from "./sql-driver.js";
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
+import type { HostSettledBy } from "../host-decision.js";
 import { type IndexSpec } from "./ensure-index.js";
 export type AskDecision = "approve" | "deny";
 export interface AskRow {
@@ -79,6 +80,32 @@ export interface AskRow {
     /** 171 ActorAssertion JSON(车4 才消费,列先在——JSON.parse 后的裸值,类型未知)。 */
     decisionActor: unknown | null;
     decisionNote: string | null;
+    /**
+     * 🔴 S-558(#1016 的持久半场)—— 这条决议的**结算来源**:`null` = 一个人答的(= 缺席律,core 对
+     * 不带这一格的 outcome 逐字按 `"human"` 读),非 null = 宿主自报的那个词(今天 wire 上只开
+     * `"policy"`,词表属主恒是 core —— 见 {@link HostSettledBy})。
+     *
+     * **为什么必须是行上的一格**(病灶,7.93.3 合并树 codex ① 验真):`settledBy` 此前只到达**当次**回决的
+     * 即时回调,行上不留痕 ⇒ 重放 / 再入 / 同 askId 的兄弟等待者 / 歧义提交恢复读回的是裸 `false`,
+     * 而裸 `false` 在 core 那边逐字是「**一个人**拒绝了」—— 模型于是又读到那句「用户不想继续,停下来等他」,
+     * 在一条根本没有人的 run 里。不变量:**一条决议的来源在所有读回路径上是同一个事实**;唯一读回铸点 =
+     * `tool-approval.ts` 的 `outcomeOfDecidedRow`。
+     *
+     * 🔴 **为什么是自己一列,不是塞进 `decision_actor` 那只袋**(S-558 取舍,亲读后定):
+     *  · 那只袋是**自由载荷**——型是 `unknown`(见上一格),读回不过任何 schema(`parseJsonColumn` 返回
+     *    `unknown`),schema 属主在别处([ref] ActorAssertion),`adoption/plan.ts` 的裁定 D2 把它连同
+     *    `decision_note` 一起定为**史实字段,永不改写**。往一只没有属主、没有类型化读回的袋里塞一个
+     *    **执行面**的判别位 = 让一格决定「工具跑不跑、模型读哪一句」的事实寄生在一个只做审计的载荷上。
+     *  · 更硬的一条:**live 回决腿根本不写那只袋**(`respondWithCas` 的 `decideAsk` 入参里没有
+     *    `decisionActor`,列恒 NULL)。来源位进袋 ⇒ 那条腿得为了捎一个词现铸一只它压根没有的 actor
+     *    ——凭空发明「谁按的」,正是 `hostDecisionFacts` 顶注禁的那件事。
+     *  · 一列的代价已经由本仓的 SCHEMA POLICY 定死且**与既有两批加列同形**([ref] 两列、[ref] 一列):
+     *    改 CREATE + 启动期响亮拒(见 {@link assertApprovalAskRuleMaterialSchema}),零 ALTER、零双读、
+     *    老行 NULL 恒读成「人决」。
+     *
+     * 三态收成两态是刻意的:`"human"` 与缺席在 core 那边逐字同义,故店只存「非人」的那些词,`null` 即人。
+     */
+    settledBy: HostSettledBy | null;
     /**
      * [ref]([ref] / [ref] 收口):人批准时带的 **ctrl+g 编辑实参**(wire `updatedInput`),与决议**同一条
      * UPDATE** 原子落列 `updated_input`。语义三态,读法**严格**:
@@ -199,6 +226,14 @@ export interface DecideAskInput {
     decisionNote?: string | null;
     /** 车4 §12-E:回决幂等键,赢 CAS 时随决议一起落列(见 `AskRow.idempotencyKey`)。缺席 ⇒ 列保持 NULL。 */
     idempotencyKey?: string | null;
+    /**
+     * 🔴 S-558:本次回决的**结算来源**,与决议同一条 UPDATE 落列 `settled_by`(语义/两态读法/为什么是
+     * 自己一列,全在 {@link AskRow.settledBy})。缺席 ⇒ 列 NULL ⇒ 读回是「一个人答的」。
+     *
+     * 店**不判词**(词表属主是 core):写什么存什么。店只判**形** —— `assertDecideSettledBy` 的两条
+     * (长度 ≤ 列宽、只与 `deny` 同行),理由见那只门的顶注;三 twin 同判。
+     */
+    settledBy?: HostSettledBy;
     /** [ref]:ctrl+g 编辑实参,与决议同一条 UPDATE 落列(语义三态见 {@link AskRow.updatedInput})。
      *  缺席 / `undefined` ⇒ 列 NULL(没带编辑);**`null` 是值**(编辑成 null),照存 JSON `"null"`。
      *  调用方纪律:deny 不传(店不替调用方判决议方向,写什么存什么)。 */
@@ -233,6 +268,24 @@ export type DecideResult = {
  *  的 deadline 铸点)负责给整数,本守卫只拦漏网。 */
 export declare function assertIntegralEpochMs(field: string, value: number): void;
 export declare function assertIdempotencyKeyShape(key: string): void;
+/** `settled_by` 列宽 = 这一格的唯一尺(两方言 DDL 与下面的形门读同一个常量,不手抄第二份)。 */
+export declare const MAX_SETTLED_BY_CHARS = 16;
+/**
+ * S-558 的**入店卫生门**(三 twin 同判,与 {@link assertIdempotencyKeyShape} / {@link assertIntegralEpochMs} 同族)。
+ * 判的是**形**,不是**词** —— 词表属主恒是 core(`resolveAsk` 对自报词表外的值是响亮 fail-closed deny),
+ * 本层一个词都不认识。两条:
+ *
+ * ① **长度 ≤ 列宽**。`settled_by` 是 `VARCHAR(16)` 的闭集词列,而值来自 wire(两条回决腿只证得出「它是个串」)。
+ *    不拦的话:MySQL 协议侧非严格模式**静默截断**、PG 侧直接报错 —— 同一份调用方代码在两个后端拿到两种
+ *    答案(`assertIdempotencyKeyShape` 的 PAD SPACE 论证逐字同源),而**被截断过的词与原词是两个词**:
+ *    一条决议的来源在库里变成了另一件事。空串同拒(core 那边它不是词,存进去只会读成一个假的「非人」)。
+ * ② **只与 `deny` 同行**。core 的契约明写两个非人词只在 `allow:false` 上合法(`{allow:true,settledBy}` 是
+ *    fail-closed 拒),两条回决腿也都在**裁决之前**照此响亮拒(`tool-approval.ts` 的
+ *    `SETTLED_BY_DENY_ONLY`,两腿共用一份文案)。在店门口再执行一次不是「第二个判官」:判的不是词而是**这一对列能不能共存**。
+ *    收益是结构性的 —— 「approve 行带来源位」从此在写面不可表示,读回铸点(`outcomeOfDecidedRow`)的 allow 臂
+ *    因此**证得出**不会丢掉任何真事实,而不是靠记性。
+ */
+export declare function assertDecideSettledBy(decision: Pick<DecideAskInput, "decision" | "settledBy">): void;
 /**
  * [ref] 车3 刀 3b(§14.2 遗留记账):两条**重放读口**被调用方的 deadline 掐断时抛的具名错误。
  *
@@ -277,6 +330,9 @@ export type AskTerminalClaimCurrent = {
     decision: AskDecision | null;
     /** [ref] 三态读法照 {@link AskRow.updatedInput}:键缺席 = 没带编辑;`null` 是编辑成 null 的值。 */
     updatedInput?: unknown;
+    /** S-558:赢家决议的**结算来源**(语义与两态读法见 {@link AskRow.settledBy})。**必填**(不是可选)——
+     *  可选会让投影漏挑这一列时静默编译过,而漏挑的后果恰是本批要修的病:CAS 输家把赢家的策略拒读成人拒。 */
+    settledBy: HostSettledBy | null;
 };
 /**
  * 单次原子往返的答案(语义律的唯一规范陈述点 = core `checkpoint-store.ts` `claimTerminal` 契约 JSDoc,

package/dist/plugins/approval-ask-store-sql.js

@@ -12,6 +12,18 @@ export function assertIdempotencyKeyShape(key) {
         throw new Error(`invalid idempotency key: must be 1-255 chars with no leading/trailing whitespace (got ${JSON.stringify(key.slice(0, 32))}${key.length > 32 ? "…" : ""}, length ${key.length})`);
     }
 }
+export const MAX_SETTLED_BY_CHARS = 16;
+export function assertDecideSettledBy(decision) {
+    const v = decision.settledBy;
+    if (v === undefined)
+        return;
+    if (v.length === 0 || v.length > MAX_SETTLED_BY_CHARS) {
+        throw new Error(`invalid settledBy: the settlement source is one word from the engine's closed set and lands in a VARCHAR(${MAX_SETTLED_BY_CHARS}) column — must be 1-${MAX_SETTLED_BY_CHARS} chars (got ${JSON.stringify(v.slice(0, 32))}${v.length > 32 ? "…" : ""}, length ${v.length})`);
+    }
+    if (decision.decision !== "deny") {
+        throw new Error(`invalid settledBy: a settlement source is only representable on a deny row (got decision="${decision.decision}") — only a person approves an action that EXECUTES, so an approve row carrying a non-human settlement source is a row no replay could honestly hand back to the engine`);
+    }
+}
 export class ApprovalAskReadAbortedError extends Error {
     constructor(where) {
         super(`approval-ask read ${where} aborted by caller`);
@@ -47,6 +59,7 @@ export function projectAskTerminalClaimTruth(row) {
         rev: row.rev,
         decision: row.decision,
         ...(row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {}),
+        settledBy: row.settledBy,
     };
 }
 export const APPROVAL_ASK_TABLE = "approval_ask";
@@ -87,6 +100,12 @@ export const TIDB_APPROVAL_ASK_STATEMENTS = [
     decision VARCHAR(16) NULL,
     decision_actor TEXT NULL,
     decision_note TEXT NULL,
+    -- settled_by(S-558 / #1016 持久半场):这条决议的结算来源词(NULL = 人答的)。语义、两态读法与
+    -- 「为什么是自己一列而不是塞进 decision_actor」的全文见 AskRow.settledBy 顶注。
+    -- VARCHAR(16):词表属主是 core(AskOutcome.settledBy,今天最长 7 字符 "timeout"),宽度与同表
+    -- decision 同尺同理由 —— 闭集词列,不是自由文本。截断面由入店形门堵死(assertDecideSettledBy),
+    -- 不靠「列够宽就不会截」这种运气(MySQL 非严格模式静默截、PG 直接报错 = 两方言不同答)。
+    settled_by VARCHAR(16) NULL,
     -- updated_input(S-26 / #304,A-054.15 收口):人批准时带的 ctrl+g 编辑实参,JSON 文本,与决议同一条
     -- UPDATE 原子落列;NULL = 没带编辑(与 JSON "null" = 编辑成 null 分家)。LONGTEXT 照 card_json 先例:
     -- 编辑实参是整只工具入参,VARCHAR/TEXT 会造静默截断面。语义三态与读法见 AskRow.updatedInput 顶注。
@@ -166,6 +185,8 @@ export async function ensurePgApprovalAskSchema(q) {
     decision VARCHAR(16) COLLATE "C",
     decision_actor TEXT COLLATE "C",
     decision_note TEXT COLLATE "C",
+    -- settled_by(S-558)—— MySQL 孪生逐字同形(宽度/语义/形门的理由写在那侧的行内注)。
+    settled_by VARCHAR(16) COLLATE "C",
     -- updated_input(S-26 / #304)—— MySQL 孪生逐字同形(语义/类型理由见那侧行内注;PG TEXT 无长度上限)。
     updated_input TEXT COLLATE "C",
     decided_at_ms BIGINT,
@@ -211,7 +232,7 @@ export async function assertApprovalAskRuleMaterialSchema(query, dialect) {
     }
 }
 const ASK_COLS = "ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, " +
-    "provisional, rev, decision, decision_actor, decision_note, updated_input, decided_at_ms, denied_reason, gate_token, " +
+    "provisional, rev, decision, decision_actor, decision_note, settled_by, updated_input, decided_at_ms, denied_reason, gate_token, " +
     "gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, " +
     "created_at_ms, updated_at_ms";
 const BATCH_COLS = "batch_id, task_id, state, bound_ask_id, rev, created_at_ms, updated_at_ms";
@@ -245,6 +266,7 @@ function mapAskRow(r) {
         decision: strOrNull(r.decision) ?? null,
         decisionActor: r.decision_actor == null ? null : parseJsonColumn(r.decision_actor),
         decisionNote: strOrNull(r.decision_note),
+        settledBy: strOrNull(r.settled_by),
         ...(r.updated_input == null ? {} : { updatedInput: parseJsonColumn(r.updated_input) }),
         decidedAtMs: numOrNull(r.decided_at_ms),
         deniedReason: strOrNull(r.denied_reason),
@@ -331,9 +353,9 @@ export class SqlApprovalAskStore {
         try {
             await conn.begin();
             await conn.query(this.q(`INSERT IGNORE INTO ${APPROVAL_BATCH_TABLE} (batch_id, task_id, state, rev, created_at_ms, updated_at_ms) VALUES (?, ?, 'OPEN', 0, ?, ?)`, `INSERT INTO ${APPROVAL_BATCH_TABLE} (batch_id, task_id, state, rev, created_at_ms, updated_at_ms) VALUES ($1, $2, 'OPEN', 0, $3, $4) ON CONFLICT (batch_id) DO NOTHING`), [row.batchId, row.taskId, now, now]);
-            const askInsert = await conn.query(this.q(`INSERT IGNORE INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
-                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, ?, ?)", `INSERT INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
-                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, $11, $12, $13, $14, $15, $16, $17) ON CONFLICT (ask_id) DO NOTHING"), [
+            const askInsert = await conn.query(this.q(`INSERT IGNORE INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, settled_by, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
+                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, ?, ?)", `INSERT INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, settled_by, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
+                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, $11, $12, $13, $14, $15, $16, $17) ON CONFLICT (ask_id) DO NOTHING"), [
                 row.askId,
                 row.taskId,
                 row.sourceTaskId,
@@ -389,6 +411,7 @@ export class SqlApprovalAskStore {
     async decideAsk(askId, batchId, decision) {
         if (decision.idempotencyKey != null)
             assertIdempotencyKeyShape(decision.idempotencyKey);
+        assertDecideSettledBy(decision);
         const now = Date.now();
         const dialect = this.db.dialect;
         const conn = await this.db.connect();
@@ -401,10 +424,11 @@ export class SqlApprovalAskStore {
             }
             let askRes;
             try {
-                askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state='DECIDED', decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, updated_input=${ph(dialect, 4)}, decided_at_ms=${ph(dialect, 5)}, idempotency_key=${ph(dialect, 6)}, rev=rev+1, updated_at_ms=${ph(dialect, 7)} WHERE ${pendingClaimWhere(dialect, 8)}`, [
+                askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state='DECIDED', decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, settled_by=${ph(dialect, 4)}, updated_input=${ph(dialect, 5)}, decided_at_ms=${ph(dialect, 6)}, idempotency_key=${ph(dialect, 7)}, rev=rev+1, updated_at_ms=${ph(dialect, 8)} WHERE ${pendingClaimWhere(dialect, 9)}`, [
                     decision.decision,
                     decision.decisionActor == null ? null : this.json(decision.decisionActor),
                     decision.decisionNote ?? null,
+                    decision.settledBy ?? null,
                     decision.updatedInput === undefined ? null : this.json(decision.updatedInput),
                     now,
                     decision.idempotencyKey ?? null,

package/dist/tool-approval.d.ts

@@ -1,9 +1,9 @@
-import type { HostDecidedBy } from "./host-decision.js";
+import type { HostDecidedBy, HostSettledBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
 import { type AskRequest, type AskOutcome, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
-import { type ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
+import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
 import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 /** [ref]:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
@@ -613,27 +613,6 @@ export declare function parseToolApprovalResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/**
- * core 5.23.0([ref]/[ref]②)—— **宿主自报**的结算来源,`AskOutcome` 对象臂新开的口。本仓在这一格上有
- * **两种身份**,合成一只座是刻意的(两只座 = 同一个 wire 位的两个写者):
- *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
- *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
- *    永远被记成「一个人拒绝了」;
- *  · **转**(调用方在回决体里自报的事实,core 7.26.2 / #1016 起):`settledBy:"policy"` = 答这张卡的是
- *    **这台部署自己的策略**,不是人。本仓**零判据、原样过境**:词的拒绝逻辑归引擎(`resolveAsk` 对
- *    自报词表外的值是响亮 fail-closed deny),本仓抄一份词表的那天 core 加词就会被静默 400 掉。
- * 逐词(词表属主恒是 core):
- *  · `"human"` —— 与「不铸这个键」逐字同义(core 缺席即按人处理);
- *  · `"aborted"` —— core **明令拒收**宿主自报(那是引擎自家 fail-closed 端的词,宿主自报等于把自己的
- *    拒绝改标成引擎故障),所以它**不在** `AskOutcome` 的这一格上,本型也就够不着它。
- * 类型从 core 的**同步 outcome 面**推导(不手抄):`AskOutcome` 的对象臂上 `settledBy` 是**宿主报的事实**,
- * core 7.6.0([ref] S6-A)删掉的是那张**结算词表**(`ApprovalSettledBy`),不是这一格 —— 词由 core 从
- * 这个事实铸(`human_refused` / `approval_window_expired` / `policy_refused`)。core 若改这一格的词表,
- * 这里编译期先红。
- */
-type HostSettledBy = NonNullable<Extract<AskOutcome, {
-    allow: boolean;
-}>["settledBy"]>;
 /**
  * #1016 —— wire 上**开给调用方**的那一个词,从 core 的两只闭集里取**交集**。
  *
@@ -802,6 +781,33 @@ export declare function resolveApprovalLeg(input: {
      *  「窗偏短」(安全侧,§7.3 的误差方向论证)。 */
     nowMonotonicMs: number;
 }): ApprovalLegAssembly;
+/** 一条 **DECIDED 行**能交还给引擎的全部形(`AskOutcome` 减掉 park 路由那一臂 —— 一条有决议的行
+ *  从定义上不是「投递面拿走了它」)。{@link ToolApprovalCoordinator.notifyExternalDecision} 收的就是它。 */
+export type DecidedAskOutcome = Exclude<AskOutcome, "unavailable">;
+/** 铸点的入参形 = 行上与**这条决议本身**有关的三格。整行(`AskRow`)与 claim 败方读数都满足。 */
+type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy"> & {
+    updatedInput?: unknown;
+};
+/**
+ * 🔴 **一条 DECIDED 行 → 交还给引擎的那个 outcome:全仓唯一铸点**(S-558)。
+ *
+ * 存在理由 = 这条投影此前被**手抄**在每个消费点上(`row.decision === "approve"` + `row.updatedInput`,
+ * 六处),于是给行加一格新事实就得记得改六处 —— `settledBy` 正是那个没人改到的格:一次**策略拒**在
+ * 重放 / 兄弟广播 / 歧义提交恢复三条路上全都退化成裸 `false`,而裸 `false` 在 core 那边逐字是
+ * 「**一个人**拒绝了」。手抄投影全面下线([ref]):消费点交行,形由这里铸。
+ *
+ * 三条读法,每条的属主注在别处,这里只落笔:
+ *  · **方向** —— `decision !== "approve"` 即拒(列的二值由店的 CAS 保证);
+ *  · **编辑载荷**([ref])—— `updatedInput` 键缺席 = 没带编辑 ⇒ 裸 `true`;在场(**含 `null`**)= 编辑的
+ *    字面值 ⇒ 对象臂(语义三态的唯一属主 = `AskRow.updatedInput` 顶注);
+ *  · **结算来源**(S-558)—— 行上非 null 即宿主自报的那个词(`null` = 人决,与「不铸这个键」同义;
+ *    语义属主 = `AskRow.settledBy` 顶注)。
+ *
+ * 🔴 approve 臂**不读**来源位,而且那不是「静默丢」:store 的入店形门(`assertDecideSettledBy`)让
+ * 「approve 行带来源位」在**写面不可表示** —— core 对 `{allow:true, settledBy}` 是 fail-closed 拒,
+ * 一条那样的行没有任何读回路径能诚实地交还给引擎,所以它在落库那一刻就被拒掉了,而不是在这里被吞掉。
+ */
+export declare function outcomeOfDecidedRow(row: DecidedRowFacts): DecidedAskOutcome;
 /**
  * Coordinates the live tool-approval HITL for the singleton runner. Process-local + same-replica (the pending map is
  * in memory, like QuestionCoordinator): a respond that lands on another replica finds nothing → 404. Present (passed
@@ -1194,7 +1200,7 @@ export declare class ToolApprovalCoordinator {
      * 真决议」,重复注册必须拿到**同一个**决议(approve 就是 approve)——合并会把外部批准的重复条目错
      * 结算成拒绝。已被结算过的条目再调 settle 天然无操作(幂等),所以本口对「赢家自己已 settle」安全。
      */
-    notifyExternalDecision(askId: string, allowed: boolean, updatedInput?: unknown): {
+    notifyExternalDecision(askId: string, outcome: DecidedAskOutcome): {
         settled: number;
     };
     /**

package/dist/tool-approval.js

@@ -84,6 +84,9 @@ export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a bool
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
 export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
+function respondSettledBy(parsed) {
+    return parsed.settledBy;
+}
 export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
@@ -222,21 +225,28 @@ function effectiveAskWindowMs(ttlMs, windowMarginMs, legDeadlineMonotonic, nowMo
     return Math.min(ttlMs, Math.max(0, legRemainingMs - windowMarginMs));
 }
 function replayTerminalAskRow(row) {
-    if (row.state === "DECIDED") {
-        if (row.decision !== "approve")
-            return false;
-        return row.updatedInput !== undefined ? { allow: true, updatedInput: row.updatedInput } : true;
-    }
+    if (row.state === "DECIDED")
+        return outcomeOfDecidedRow(row);
     if (row.state === "PARKING" || row.state === "PARKED")
         return "unavailable";
     return false;
 }
-function settleArgsOf(outcome) {
-    if (outcome === "unavailable")
-        return "unavailable";
+export function outcomeOfDecidedRow(row) {
+    if (row.decision !== "approve")
+        return row.settledBy !== null ? { allow: false, settledBy: row.settledBy } : false;
+    return row.updatedInput !== undefined ? { allow: true, updatedInput: row.updatedInput } : true;
+}
+function settleArgsOfDecided(outcome) {
     if (typeof outcome === "boolean")
         return { allowed: outcome };
-    return { allowed: outcome.allow, ...(outcome.updatedInput !== undefined ? { updatedInput: outcome.updatedInput } : {}) };
+    return {
+        allowed: outcome.allow,
+        ...(outcome.updatedInput !== undefined ? { updatedInput: outcome.updatedInput } : {}),
+        ...(outcome.settledBy !== undefined ? { settledBy: outcome.settledBy } : {}),
+    };
+}
+function settleArgsOf(outcome) {
+    return outcome === "unavailable" ? "unavailable" : settleArgsOfDecided(outcome);
 }
 export class ToolApprovalCoordinator {
     als = new AsyncLocalStorage();
@@ -616,16 +626,17 @@ export class ToolApprovalCoordinator {
     classifyClaimLoss(askId, current, _where) {
         if (current.state === "absent")
             return { kind: "absent" };
-        const replayed = settleArgsOf(replayTerminalAskRow(current));
-        if (replayed === "unavailable")
+        const replayedOutcome = replayTerminalAskRow(current);
+        if (replayedOutcome === "unavailable")
             return { kind: "parked" };
+        const replayed = settleArgsOfDecided(replayedOutcome);
         if (!replayed.allowed)
-            return { kind: "denied" };
+            return { kind: "decided", outcome: replayedOutcome };
         if (replayed.updatedInput !== undefined)
-            return { kind: "approved", updatedInput: replayed.updatedInput };
+            return { kind: "decided", outcome: replayedOutcome };
         if (this.editedDecisionInFlight(askId))
             return { kind: "edit-in-flight" };
-        return { kind: "approved" };
+        return { kind: "decided", outcome: replayedOutcome };
     }
     hasOtherSuspendedOwner(askId, self) {
         if (askId === undefined)
@@ -713,13 +724,14 @@ export class ToolApprovalCoordinator {
         }
         return tomb;
     }
-    notifyExternalDecision(askId, allowed, updatedInput) {
+    notifyExternalDecision(askId, outcome) {
         const entries = this.pendingByAskId.get(askId);
         if (!entries)
             return { settled: 0 };
+        const args = settleArgsOfDecided(outcome);
         let settled = 0;
         for (const entry of [...entries]) {
-            entry.settle(allowed, allowed ? "allowed" : "denied", updatedInput);
+            entry.settle(args.allowed, args.allowed ? "allowed" : "denied", args.updatedInput, args.settledBy);
             settled += 1;
         }
         return { settled };
@@ -1091,11 +1103,8 @@ export class ToolApprovalCoordinator {
             if (askId === undefined)
                 return;
             switch (read.kind) {
-                case "approved":
-                    this.notifyExternalDecision(askId, true, read.updatedInput);
-                    return;
-                case "denied":
-                    this.notifyExternalDecision(askId, false);
+                case "decided":
+                    this.notifyExternalDecision(askId, read.outcome);
                     return;
                 case "parked":
                     this.settleSameAskIdParkRoute(askId);
@@ -1111,14 +1120,12 @@ export class ToolApprovalCoordinator {
         };
         const settleFromClaimLoss = (read) => {
             switch (read.kind) {
-                case "approved":
-                    settle(true, "allowed", read.updatedInput);
-                    broadcastClaimTruth(read);
-                    return true;
-                case "denied":
-                    settle(false, "denied");
+                case "decided": {
+                    const args = settleArgsOfDecided(read.outcome);
+                    settle(args.allowed, args.allowed ? "allowed" : "denied", args.updatedInput, args.settledBy);
                     broadcastClaimTruth(read);
                     return true;
+                }
                 case "parked":
                     windowRouteUnavailable = true;
                     settle(false, "expired");
@@ -1622,7 +1629,7 @@ export class ToolApprovalCoordinator {
             });
             return this.notPending();
         }
-        this.notifyExternalDecision(row.askId, row.decision === "approve", row.updatedInput);
+        this.notifyExternalDecision(row.askId, outcomeOfDecidedRow(row));
         return {
             status: 200,
             body: {
@@ -1895,21 +1902,23 @@ export class ToolApprovalCoordinator {
         }
     }
     async respondWithCas(askStore, askId, batchId, id, entry, parsed, ruleEligibility) {
-        let decidedWon = false;
-        let confirmedRowPayload;
+        let winnerRow;
+        let ambiguousConfirmedRow;
         let noteLanded = false;
         try {
             const decided = await this.withStoreDeadline(askStore.decideAsk(askId, batchId, {
                 decision: parsed.value === "deny" ? "deny" : "approve",
                 ...(parsed.note !== undefined ? { decisionNote: parsed.note } : {}),
                 ...(parsed.value !== "deny" && parsed.updatedInput !== undefined ? { updatedInput: parsed.updatedInput } : {}),
+                ...(parsed.settledBy !== undefined ? { settledBy: respondSettledBy(parsed) } : {}),
             }), "decideAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
                 if (late.ok)
-                    this.notifyExternalDecision(askId, parsed.value !== "deny", parsed.updatedInput);
+                    this.notifyExternalDecision(askId, outcomeOfDecidedRow(late.row));
             });
-            decidedWon = decided.ok;
-            if (decided.ok)
+            if (decided.ok) {
+                winnerRow = decided.row;
                 noteLanded = true;
+            }
             if (!decided.ok) {
                 return this.notPending();
             }
@@ -1920,8 +1929,8 @@ export class ToolApprovalCoordinator {
             try {
                 const row = await this.withStoreDeadline(askStore.getAsk(askId), "getAsk(decideAsk-confirm)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
                 if (row?.state === "DECIDED" && row.decision === (parsed.value === "deny" ? "deny" : "approve")) {
-                    decidedWon = true;
-                    confirmedRowPayload = { updatedInput: row.updatedInput };
+                    winnerRow = row;
+                    ambiguousConfirmedRow = row;
                     noteLanded = parsed.note === undefined || row.decisionNote === parsed.note;
                 }
             }
@@ -1930,22 +1939,25 @@ export class ToolApprovalCoordinator {
             }
         }
         const wantAllowed = parsed.value !== "deny";
+        const decidedWon = winnerRow !== undefined;
         if (this.pending.get(id) !== entry) {
-            if (decidedWon)
-                this.notifyExternalDecision(askId, wantAllowed, confirmedRowPayload !== undefined ? confirmedRowPayload.updatedInput : parsed.updatedInput);
+            if (winnerRow !== undefined)
+                this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow));
             const converged = decidedWon && entry.settledOutcome === (wantAllowed ? "allowed" : "denied");
             if (!converged) {
                 return this.notPending();
             }
             return this.finishRespond(id, entry, parsed, { updatedInputDelivered: false, noteRecorded: noteLanded });
         }
-        const payloadIsMine = confirmedRowPayload === undefined ||
-            approvalPayloadFingerprint({ updatedInput: confirmedRowPayload.updatedInput }) === approvalPayloadFingerprint({ updatedInput: parsed.updatedInput });
+        const payloadIsMine = ambiguousConfirmedRow === undefined ||
+            approvalPayloadFingerprint({ updatedInput: ambiguousConfirmedRow.updatedInput }) === approvalPayloadFingerprint({ updatedInput: parsed.updatedInput });
         const result = this.finishRespond(id, entry, parsed, {
             noteRecorded: noteLanded,
-            ...(confirmedRowPayload !== undefined ? { settlePayload: confirmedRowPayload, updatedInputDelivered: payloadIsMine } : {}),
+            ...(winnerRow !== undefined ? { settleOutcome: outcomeOfDecidedRow(winnerRow) } : {}),
+            ...(ambiguousConfirmedRow !== undefined ? { updatedInputDelivered: payloadIsMine } : {}),
         });
-        this.notifyExternalDecision(askId, wantAllowed, confirmedRowPayload !== undefined ? confirmedRowPayload.updatedInput : parsed.updatedInput);
+        if (winnerRow !== undefined)
+            this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow));
         return result;
     }
     finishRespond(id, entry, parsed, opts) {
@@ -1962,7 +1974,8 @@ export class ToolApprovalCoordinator {
             this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName)));
         }
         const allowed = parsed.value !== "deny";
-        entry.settle(allowed, allowed ? "allowed" : "denied", opts?.settlePayload !== undefined ? opts.settlePayload.updatedInput : parsed.updatedInput, parsed.settledBy, allowed ? undefined : parsed.note);
+        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: respondSettledBy(parsed) };
+        entry.settle(settleArgs.allowed, settleArgs.allowed ? "allowed" : "denied", settleArgs.updatedInput, settleArgs.settledBy, settleArgs.allowed ? undefined : parsed.note);
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;
         const noteRecorded = opts?.noteRecorded ?? false;
         return {
@@ -2035,14 +2048,14 @@ export class ToolApprovalCoordinator {
                 continue;
             if (this.editedDecisionInFlight(askId))
                 continue;
-            const outcome = settleArgsOf(replayTerminalAskRow(row));
+            const outcome = replayTerminalAskRow(row);
             if (outcome === "unavailable") {
                 const before = this.pendingByAskId.get(askId)?.size ?? 0;
                 this.settleSameAskIdParkRoute(askId);
                 settled += before;
                 continue;
             }
-            const delivered = this.notifyExternalDecision(askId, outcome.allowed, outcome.updatedInput).settled;
+            const delivered = this.notifyExternalDecision(askId, outcome).settled;
             settled += delivered;
         }
         const backlog = Math.max(0, candidates.length - polled);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.93.3",
+  "version": "7.93.4",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -74,7 +74,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "11.2.1",
+    "@sema-agent/sdk": "11.3.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",