A Permission Change Has One Public Truth

RC4 passed its ordinary permission tests. It could lower a Work Room from Full Access to Auto, persist the narrower catalog, reject a stale elevated choice, and reconnect without granting new authority. Then the release gate added one operation before the downgrade: stop a real native Codex follow-up.

Stop worked. Codex received the provider-scoped interrupt rather than an outer agent interrupt, the run settled as Stopped, and the Work Room restored its composer. But the terminal continuation did not repeat an unchanged permission catalog. When the outer mode changed next, the Host normalized that continuation under the old Full Access ceiling, appended a repair snapshot, committed Auto, and appended the real downgrade. Both events were valid in isolation. Together they exposed two answers to one permission change.

That distinction matters because a network client does not observe a database transaction as an abstract final state. It observes frames in order, may render or persist each frame, and may reconnect between them. An intermediate snapshot with broader authority is not harmless merely because a narrower snapshot is scheduled behind it. The first public answer can become the durable answer at exactly the boundary where delivery, coalescing, or reconnection changes.

RC5 makes the transaction match the user's action. The Host normalizes ordinary session policy without publishing provider authority, commits the requested outer mode, and then reconciles every affected Work Room exactly once. A Full Access to Auto change therefore emits one provider permission revision with Ask for approval active and Full Access disabled. A Read-only change emits one revision with every broader choice disabled. There is no old-ceiling repair for the browser to misunderstand.

The client has a matching responsibility. A completed, failed, or stopped Work Room is still a remote Codex or Claude Code client, so losing its permission selector and input box is not an acceptable simplification. O Chat now retains the latest Host-verified catalog only inside the same explicit Work Room and provider. A newer terminal snapshot replaces that fallback immediately; the browser never invents authority or borrows it from another conversation.

The regression test recreates the exact sequence that RC4 exposed, for both Auto and Read-only. The release gate will recreate it again with public RC5 bytes, native Codex and Claude Code processes, outer-mode changes, reconnects, and desktop and mobile screenshots. The lesson is broader than this bug: one authority-changing user action must have one externally observable truth, and that truth must already be the final one.