Human-in-the-loop is not a receipt.

Local guards and full-access MCP servers often pause after DML so a person can review. That pause is valuable UX. It usually lives inside one client session.

Another host calling the same tool tomorrow does not inherit the pause. Neither does next week’s incident review when the thread is gone.

Yes → receipt → verify → execute

Collect the human yes however you like — elicitation, [y/N], ticket. Then mint a receipt over the exact SQL hash and verify it at execute time.