fix: harden Human Gates review flow

src/human_gate_store.py

@@ -212,8 +212,26 @@ class HumanGateStore:
                 (login, payload["source"], payload["project"], payload["candidate_hash"]),
             ).fetchone()
             if existing:
-                if _fingerprint(json.loads(existing["payload_json"])) != fingerprint:
+                old_payload = json.loads(existing["payload_json"])
+                immutable_old = {key: value for key, value in old_payload.items() if key != "checks"}
+                immutable_new = {key: value for key, value in payload.items() if key != "checks"}
+                if immutable_old != immutable_new:
                     raise GateConflict("Candidate hash is already bound to different facts")
+                if old_payload != payload:
+                    now = float(self.clock())
+                    revision = existing["revision"] + 1
+                    connection.execute(
+                        "UPDATE human_gates SET payload_json=?, revision=?, updated_at=? WHERE id=?",
+                        (_canonical(payload), revision, now, existing["id"]),
+                    )
+                    connection.execute(
+                        "INSERT INTO human_gate_history(gate_id,action,at,details_json) VALUES (?,?,?,?)",
+                        (existing["id"], "updated", now, _canonical({"candidate_hash": payload["candidate_hash"]})),
+                    )
+                    existing = connection.execute(
+                        "SELECT * FROM human_gates WHERE id=? AND login=?",
+                        (existing["id"], login),
+                    ).fetchone()
                 connection.execute("INSERT INTO human_gate_intake_keys VALUES (?,?,?,?)", (login, key, fingerprint, existing["id"]))
                 return self._present(connection, existing, history=True)
             now, gate_id = float(self.clock()), str(uuid.uuid4())

src/main.py

@@ -1818,10 +1818,10 @@ def health() -> dict[str, str]:
 
 async def _human_gate_login(request: Request) -> str:
     session = getattr(request.state, "dashboard_session", None)
-    if session is not None and session.principal_login:
-        return session.principal_login
-    _principal_id, login = await _upstream_identity()
-    return login
+    if session is not None and session.principal_login and session.principal_id:
+        return f"{session.principal_id}:{session.principal_login}"
+    principal_id, login = await _upstream_identity()
+    return f"{principal_id}:{login}"
 
 
 def _gate_error(error: Exception) -> HTTPException: