# A Mode Is Not a Compatibility Shim

Defining three mode names was the easy part. The runtime still contained years
of helpful behavior around them: old session keys were translated, public
aliases remained callable, and Full access could prompt the agent into another
turn after a checkpoint. Each behavior had once made an upgrade gentler. In a
permission boundary, they also made the effective contract larger than the one
we claimed to ship.

The dangerous case was not a malformed request. It was a plausible old value.
If a stored `:danger-full-access` marker silently became `full-access`, a new
client had manufactured current authority from stale state. If a Plan value
shared the mode channel, a progress preference could be mistaken for a policy
decision. If Full access continued by itself, a bounded approval bypass had
become an autonomous loop.

The 1.7 runtime now treats the Host acknowledgement as the only authority. Core
stores only `mode` and, for bounded Full access, `turns_left`. One writer changes
that state. Unknown or legacy stored fields are removed and the session returns
to Auto. The Python client rejects an acknowledgement whose mode, budget, or
advertised choices do not satisfy the same contract.

Provider adapters may still translate at their private edge. Claude and Codex
do not need identical internal words; users do need identical public meaning.
That boundary lets the provider evolve without leaking another vocabulary into
React, O Chat, documentation, or durable session state.

The regression suite follows the awkward paths rather than only the happy
button click: fresh sessions for every participant, old stored state, duplicate
advertisements, invalid budgets, reconnect acknowledgements, completed turns,
and expiry back to Auto. The full unit suite and package build then exercise the
rest of the system around those checks.

Compatibility is valuable for data. It is unsafe when it guesses authority.
For a mode, rejecting ambiguity is the migration path.