The First Correct Snapshot Was Still Wrong

The RC4 gate stopped a real Codex follow-up, then lowered the outer session from Full Access to Auto. The provider stopped correctly. The outer mode changed correctly. Storage even contained an Auto-bounded provider snapshot. Yet the reopened Work Room could retain Full Access.

The failure required a terminal continuation. Stop produced a valid cancelled provider frame without a permission catalog. While committing the later mode change, the Host first normalized that frame under the old Full Access ceiling, which appended a repair snapshot. It then applied Auto and appended the real downgrade. Both snapshots belonged to one transaction and both were streamed. The first was individually correct and transactionally wrong.

This is why an authority transaction cannot be reviewed as a bag of valid events. Its observable result must contain only the final policy. A client that sees an intermediate broader state may persist or render it before the narrower revision arrives, especially across reconnect and coalescing boundaries.

The fix makes mode application normalize ordinary session policy without publishing provider authority. After the requested mode is committed, provider permissions reconcile exactly once. A stopped continuation therefore produces one live revision: Auto selects Codex Ask for approval and disables Full Access; Read only selects Codex Read Only and disables every broader option.

The regression recreates the exact sequence with a terminal continuation that has no catalog. It proves the WebSocket sends mode_changed followed by one, and only one, provider snapshot at the final ceiling. The release gate will now repeat the same sequence against native Codex and Claude Code before another candidate can be promoted.