diff --git a/internal/runmgr/runmgr_test.go b/internal/runmgr/runmgr_test.go
index 658f2ce..eb5a729 100644
--- a/internal/runmgr/runmgr_test.go
+++ b/internal/runmgr/runmgr_test.go
@@ -217,6 +217,24 @@ func TestResolveHITLSecondRoundKeepsTerminalStatus(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		t.Fatal("runner did not reach the second HITL question")
 	}
+	// asked 只保证 runner 已经发出提问，不保证 waiting_hitl 行与卡片都已落库；
+	// 与第 1 轮同一序列：等 run 处于 waiting_hitl 且存在未解决卡片后再读取。
+	waitUntilWithin(t, 10*time.Second, func() bool {
+		got, err := st.GetRunByID(run.ID)
+		if err != nil || got.Status != core.RunWaitingHITL {
+			return false
+		}
+		cards, err := st.ActiveHITLCards(conv.Owner, conv.ID)
+		if err != nil {
+			return false
+		}
+		for _, c := range cards {
+			if !c.Resolved {
+				return true
+			}
+		}
+		return false
+	})
 	second := pendingCard(t, st, conv, 1)
 	if got, err := st.GetRunByID(run.ID); err != nil || got.Status != core.RunWaitingHITL {
 		t.Fatalf("round 2 status=%s err=%v (want waiting_hitl)", got.Status, err)
diff --git a/internal/store/role_policy.go b/internal/store/role_policy.go
index 392b3cf..e3a6b1c 100644
--- a/internal/store/role_policy.go
+++ b/internal/store/role_policy.go
@@ -2252,7 +2252,7 @@ func (s *Store) upsertRolePermissionsTx(tx *sql.Tx, actorID, roleID string, curr
 	for _, row := range writes {
 		if _, err := tx.Exec(s.q(`INSERT INTO role_permissions(role_id,action_id,allowed,cap_allowed,permission_version,updated_by,updated_at)
 			VALUES(?,?,?,?,?,?,?) ON CONFLICT(role_id,action_id) DO UPDATE SET allowed=excluded.allowed,cap_allowed=excluded.cap_allowed,
-				permission_version=permission_version+1,updated_by=excluded.updated_by,updated_at=excluded.updated_at`),
+				permission_version=role_permissions.permission_version+1,updated_by=excluded.updated_by,updated_at=excluded.updated_at`),
 			roleID, row.ActionID, row.Allowed, row.CapAllowed, 1, actorID, now); err != nil {
 			return err
 		}