# A Permission Change Has One Public Truth

RC4 passed its ordinary permission tests. It could lower a Work Room from Full
Access to Auto, persist the narrower catalog, reject a stale elevated choice,
and reconnect without granting new authority. Then the release gate added one
operation before the downgrade: stop a real native Codex follow-up.

Stop worked. Codex received the provider-scoped interrupt rather than an outer
agent interrupt, the run settled as Stopped, and the Work Room restored its
composer. But the terminal continuation did not repeat an unchanged permission
catalog. When the outer mode changed next, the Host normalized that continuation
under the old Full Access ceiling, appended a repair snapshot, committed Auto,
and appended the real downgrade. Both events were valid in isolation. Together
they exposed two answers to one permission change.

That distinction matters because a network client does not observe a database
transaction as an abstract final state. It observes frames in order, may render
or persist each frame, and may reconnect between them. An intermediate snapshot
with broader authority is not harmless merely because a narrower snapshot is
scheduled behind it. The first public answer can become the durable answer at
exactly the boundary where delivery, coalescing, or reconnection changes.

RC5 makes the transaction match the user's action. The Host normalizes ordinary
session policy without publishing provider authority, commits the requested
outer mode, and then reconciles every affected Work Room exactly once. A Full
Access to Auto change therefore emits one provider permission revision with Ask
for approval active and Full Access disabled. A Read-only change emits one
revision with every broader choice disabled. There is no old-ceiling repair for
the browser to misunderstand.

The client has a matching responsibility. A completed, failed, or stopped Work
Room is still a remote Codex or Claude Code client, so losing its permission
selector and input box is not an acceptable simplification. O Chat now retains
the latest Host-verified catalog only inside the same explicit Work Room and
provider. A newer terminal snapshot replaces that fallback immediately; the
browser never invents authority or borrows it from another conversation.

The regression test recreates the exact sequence that RC4 exposed, for both
Auto and Read-only. The release gate will recreate it again with public RC5
bytes, native Codex and Claude Code processes, outer-mode changes, reconnects,
and desktop and mobile screenshots. The lesson is broader than this bug: one
authority-changing user action must have one externally observable truth, and
that truth must already be the final one.