@agentcomms/resend 0.21.0 → 0.23.0

package/dist/index.d.mts

@@ -4322,26 +4322,7 @@ declare namespace external_d_exports {
   export { $brand, $input, $output, BRAND, CompileOptions, GlobalMeta, INVALID, Infer$1 as Infer, IssueData, JSONType, NEVER, $RefinementCtx as RefinementCtx, SafeExtendShape, Schema, TimePrecision, TypeOf, ZodAny, ZodArray, ZodBase64, ZodBase64URL, ZodBigInt, ZodBigIntFormat, ZodBoolean, ZodCIDRv4, ZodCIDRv6, ZodCUID, ZodCUID2, ZodCatch, ZodCodec, ZodCoercedBigInt, ZodCoercedBoolean, ZodCoercedDate, ZodCoercedNumber, ZodCoercedString, ZodCompileAsyncError, ZodCompileUnsupportedError, ZodCreditCard, ZodCustom, ZodCustomStringFormat, ZodDate, ZodDefault, ZodDiscriminatedUnion, ZodE164, ZodEmail, ZodEmoji, ZodEnum, ZodError, ZodErrorMap, ZodExactOptional, ZodFile, ZodFirstPartySchemaTypes, ZodFirstPartyTypeKind, ZodFlattenedError, ZodFloat32, ZodFloat64, ZodFormattedError, ZodFunction, ZodGUID, ZodIBAN, ZodIPv4, ZodIPv6, ZodISODate, ZodISODateTime, ZodISODuration, ZodISOTime, ZodInstanceOf, ZodInt, ZodInt32, ZodInt64, ZodIntersection, ZodIssue, ZodIssueCode, ZodJSONSchema, ZodJSONSchemaInternals, ZodJWT, ZodKSUID, ZodLazy, ZodLiteral, ZodMAC, ZodMap, ZodNaN, ZodNanoID, ZodNever, ZodNonOptional, ZodNull, ZodNullable, ZodNumber, ZodNumberFormat, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPreprocess, ZodPromise, ZodRawShape$1 as ZodRawShape, ZodReadonly, ZodRealError, ZodRecord, ZodSafeParseError, ZodSafeParseResult, ZodSafeParseSuccess, ZodSchema, ZodSet, ZodStandardSchemaWithJSON, ZodString, ZodStringFormat, ZodSuccess, ZodSymbol, ZodTemplateLiteral, ZodTransform, ZodTuple, ZodType, ZodTypeAny, ZodUInt32, ZodUInt64, ZodULID, ZodURL, ZodUUID, ZodUndefined, ZodUnion, ZodUnknown, ZodVoid, ZodXID, ZodXor, _ZodBigInt, _ZodBoolean, _ZodDate, _ZodNumber, _ZodString, _ZodType, _default, _function, any, array, base64, base64url, bigint$1 as bigint, boolean$1 as boolean, _catch as catch, check, cidrv4, cidrv6, clone, codec, coerce_d_exports as coerce, compile, config, index_d_exports$1 as core, creditCard, cuid, cuid2, currencyCode, custom, date$2 as date, decode, decodeAsync, deepPartial, describe, discriminatedUnion, e164, email, emoji, encode, encodeAsync, _endsWith as endsWith, _enum as enum, exactOptional, file, flattenError, float32, float64, formatError, fromJSONSchema, _function as function, getDiscriminatedOption, getErrorMap, globalRegistry, _gt as gt, _gte as gte, guid, hash, hex, hostname, httpUrl, iban, _includes as includes, output$1 as infer, inferFlattenedErrors, inferFormattedError, input, _instanceof as instanceof, int, int32, int64, intersection, invertCodec, ipv4, ipv6, iso_d_exports as iso, json, jwt, keyof, ksuid, lazy, _length as length, literal, index_d_exports$2 as locales, looseObject, looseRecord, _lowercase as lowercase, _lt as lt, _lte as lte, mac, map, _maxLength as maxLength, _maxSize as maxSize, memoizer, meta, _mime as mime, _minLength as minLength, _minSize as minSize, _multipleOf as multipleOf, nan, nanoid, nativeEnum, _negative as negative, never, _nonnegative as nonnegative, nonoptional, _nonpositive as nonpositive, _normalize as normalize, _null as null, nullable, nullish, number$1 as number, object, optional, output, _overwrite as overwrite, parse, parseAsync, partialRecord, pipe, _positive as positive, prefault, preprocess, prettifyError, promise, _properties as properties, _property as property, readonly, record, refine, _regex as regex, regexes_d_exports as regexes, registry, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync, set, setErrorMap, _size as size, _slugify as slugify, _startsWith as startsWith, strictObject, string$1 as string, stringFormat, stringbool, success, superRefine, symbol, templateLiteral, toJSONSchema, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, toZod, transform, treeifyError, _trim as trim, tuple, uint32, uint64, ulid, _undefined as undefined, union, unknown, _uppercase as uppercase, url, util_d_exports as util, uuid, uuidv4, uuidv6, uuidv7, validate, validateAsync, _void as void, withParser, xid, xor };
 }
 //#endregion
-//#region ../core/dist/launcher-BuZRjGA8.d.mts
-//#endregion
-//#region src/config-hooks.d.ts
-/**
- * Test-only pauses inside `ConfigStore.convertToVersion3`, for the tests that prove a write racing the conversion is
- * neither lost nor let in between its scan and its write.
- *
- * Deliberately not exported from the package root, as `enableNamesMigrationForTests` is not (`release-gate.ts`): a
- * store is given them through its constructor under this symbol, which only a test importing this file by path can
- * name. No consumer of the package can reach it.
- */
-declare const CONVERSION_HOOKS: unique symbol;
-interface ConversionHooks {
-  /** After the read before the lock, before the config lock is taken. */
-  beforeLock?: (() => Promise<void> | void) | undefined;
-  /** Under the lock, after the approvals were scanned and before the version-3 write is built. */
-  afterScan?: (() => Promise<void> | void) | undefined;
-  /** Under the lock, immediately before the version-3 write. */
-  beforeWrite?: (() => Promise<void> | void) | undefined;
-}
+//#region ../core/dist/launcher-CD40rL4F.d.mts
 interface RegisteredServer {
   client: string;
   path: string;
@@ -4415,19 +4396,67 @@ interface ResolvedPaths {
    */
   downloadsDir: string;
 }
-type ErrorCode = "UNEXPECTED" | "APPROVAL_REQUIRED" | "APPROVAL_PENDING" | "APPROVAL_EXPIRED" | "APPROVAL_VOID" | "SEND_OUTCOME_UNKNOWN" | "SEND_REFUSED" | "POLICY_NEVER" | "RATE_CAPPED" | "UNSENDABLE_HTML" | "LOOSENING_REFUSED" | "NEEDS_NEWER_RELEASE" | "USAGE" | "CURSOR_MISMATCH" | "BAD_DATA" | "REPLY_INVALID" | "NOT_FOUND" | "PROVIDER_UNAVAILABLE" | "SOURCE_UNAVAILABLE" | "SECRET_STORE_UNAVAILABLE" | "TRANSIENT" | "KEYCHAIN_APPROVAL_PENDING" | "LOCK_TIMEOUT" | "AUTH_REQUIRED" | "SCOPE_MISSING" | "WHATSAPP_VISIBILITY_SEAM_REQUIRED" | "CONFIG";
-interface CommsErrorOptions {
-  hint?: string;
-  details?: Record<string, unknown>;
-  cause?: unknown;
+//#endregion
+//#region src/approval-binding.d.ts
+/**
+ * What a version-2 approval binds, defined once (design 2026-10-05 §D1, "Digest integrity").
+ *
+ * A record stores two digests. `contentDigest` is the outward content or change, computed as before: the message, the
+ * change, the download. `bindingDigest` is this module's: the content digest together with the record's route, its
+ * lifetimes and its own identity — who it belongs to, which draft, which channel, which send epoch. Every one of those
+ * is a field a claim or a report acts on, so a record whose binding no longer recomputes from its own fields has been
+ * altered since it was made, and nothing it says can be trusted.
+ *
+ * There is no second copy of anything: the binding is recomputed from the stored fields alone, never stored apart
+ * from them as a key.
+ */
+/**
+ * How an approval is decided, fixed when it is made: `chat` — a yes in the conversation is enough — or `confirm` — a
+ * person outside the chat decides. A send's route is the stricter of its live send policy and any escalation; a
+ * change's is the live change policy. It never changes when the configuration does.
+ *
+ * `standing` — the send is one use of a standing approval the person gave in advance, at a terminal with its code
+ * (design 2026-10-19-standing-approvals, S9): a child, approved when it is made, for one claim within minutes. A
+ * standing record itself is on `confirm`, whatever the change policy.
+ */
+type ApprovalRoute = "chat" | "confirm" | "standing";
+/** The four activation documents that may receive standing disclosure authority. */
+type DisclosureActivationKind = "rule" | "judge-budget" | "judge-kind" | "enable-all";
+/** An immutable version named by a standing disclosure authorisation. */
+type DisclosureVersionKind = "rule" | "target" | "subscriber" | "judge" | "judge-budget" | "judge-kind";
+interface DisclosureVersion {
+  readonly kind: DisclosureVersionKind;
+  readonly id: string;
+  readonly version: number;
 }
-declare class CommsError extends Error {
-  readonly code: ErrorCode;
-  readonly hint: string | undefined;
-  readonly details: Record<string, unknown> | undefined;
-  constructor(code: ErrorCode, message: string, options?: CommsErrorOptions);
-  get exitCode(): number;
-  get retryable(): boolean;
+/**
+ * The content-free, canonical authority for a future disclosure (local-event design D2).
+ *
+ * The event daemon derives this from one canonical activation document. Core does not construct
+ * that document; it verifies the closed shape that makes an independently supplied version list
+ * impossible to smuggle into a disclosure record.
+ */
+interface DisclosureBinding {
+  readonly digest: string;
+  readonly activationIntentId: string;
+  readonly activationKind: DisclosureActivationKind;
+  readonly versions: readonly DisclosureVersion[];
+}
+/**
+ * What a record's `inboxId` names. `owner` — a mailbox or account that existed when it was made (every send and
+ * download, and a change to one). `prospective` — a change that creates its owner, which has no id yet. `global` — a
+ * change to no owner at all, stored with `inboxId: ''`.
+ */
+type OwnerScope = "owner" | "prospective" | "global";
+/**
+ * One use of a standing approval, as its child is bound to it (design 2026-10-19-standing-approvals, S9): the channel
+ * its act goes to, the thread it is in, and the digest of the content it sends — what a claim checks its standing
+ * approval still covers.
+ */
+interface StandingUseBinding {
+  channel: string;
+  thread: string;
+  content: string;
 }
 /**
  * The file operations a lock is made of, one method each, so a test can count and interrupt every one of them: the
@@ -4449,1039 +4478,804 @@ interface LockIo {
   remove(path: string): Promise<void>;
 }
 //#endregion
-//#region src/cli-command.d.ts
-/**
- * The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
- *
- * A bare `agent-gmail approve …` is not runnable for most of the people it is printed for: a package run by npx, by a
- * managed runtime or from a checkout puts nothing on their PATH. So every such command names this process's Node and
- * a checked file of the product it runs, with the suite directories it uses pinned as options — and when no file can
- * be checked, there is no command at all, only a sentence saying what is missing. The caller says which package it is
- * and what to run; it never supplies the program or quotes the line.
- *
- * Three directions. A product's own CLI is found from the product itself, walking from one of its own modules to its
- * manifest: no registration is ever asked. A channel's handoff to core is found the way the channel itself finds core,
- * through its installed dependency, and only the same release. Another product's command is found among the servers
- * registered with the person's MCP clients, which the caller scanned and passes in: only a file-backed registration of
- * exactly the printing package's version, checked on disk. Nothing a registration names is run, or asked anything —
- * not even its interpreter for a version: no installer wrote down where a scanned entry came from, so none is trusted
- * to run (D1). This module never scans, spawns or probes.
- *
- * What is checked is checked when the command is printed, not for ever (D6): the file it names is real, readable and
- * inside its package then, and a later change to that installation is a later fact.
- */
-/** The gate a constructor call has to pass: only this module holds it. */
-declare const GATE$1: unique symbol;
+//#region src/approval-io.d.ts
 /**
- * A command that runs one of this suite's own CLIs, made only by `locateCliCommand`. Rendered as every printed command
- * is — a line to paste, or on Windows its words as JSON when no line is safe in every shell (`inlineCommand`,
- * `commandText`).
+ * The file operations approval maintenance and the unsent report are made of (design 2026-10-05 §D9), one method
+ * each, so that a test can count every one of them — every directory read, metadata stat, record open, lock try,
+ * renewal, ownership check and unlink — and none is hidden behind a helper. The store passes the real ones unless it
+ * was opened with others.
  *
- * A class with a private field, so the type is nominal: an object literal with the same fields is not one, and nor is
- * a spread copy of one with other words in it, as it would be with a symbol-keyed brand. Only the type is exported;
- * the class and its gate are not.
+ * Only these two passes go through it: every other read and write of the store is as it was.
  */
-declare class PrintedCommand {
-  #private;
-  /** The words, as the program is to receive them: this Node, its flags, the entry, then the CLI's own words. */
-  readonly words: readonly string[];
-  /** The line to paste; null when no supported common or labelled shell rendering is safe. */
-  readonly line: string | null;
-  readonly platform: NodeJS.Platform;
-  readonly shell?: "powershell" | undefined;
-  constructor(gate: typeof GATE$1, words: readonly string[], platform: NodeJS.Platform, entry: string);
-  /**
-   * The real path of the file it runs, as it was checked when the command was located: a fact about then (D6). The
-   * command names this path and nothing else, so what runs is whatever is there when the person runs it.
-   */
-  get entry(): string;
-  /**
-   * As JSON — a result's field written out by `--json`, or returned to an MCP client — it is the text it always was:
-   * its line, or its words as JSON with what to do when no Windows line is safe (`commandText`). Rendered where it
-   * leaves the process, so a field can hold the command itself and the wire stays the same.
-   */
-  toJSON(): string;
-  /** Never interpolated: a sentence gives a command through `handoffSentence`, a value through `handoffText`. */
-  [Symbol.toPrimitive](): never;
-}
-/** The package asking: a module of its own (`import.meta.url`), and the package that module is expected to be in. */
-interface CliCommandCaller {
-  readonly url: string;
-  readonly packageName: string;
+interface ApprovalIo {
+  /** One enumeration of a directory: its entries' names. */
+  readdir(directory: string): Promise<string[]>;
+  /** One metadata stat: the modification time, in milliseconds. */
+  stat(path: string): Promise<{
+    readonly mtimeMs: number;
+  }>;
+  /** One open of a file's content, as text. */
+  readText(path: string): Promise<string>;
+  /** Replaces a file atomically — a temporary file, flushed, renamed — and, when `durable`, syncs its directory too. */
+  writeAtomic(path: string, text: string, options?: {
+    durable?: boolean;
+  }): Promise<void>;
+  /** One unlink of an approval artifact: a record or its claim marker. A missing one rejects with `ENOENT`. */
+  unlink(path: string): Promise<void>;
+  /** The lock files' own operations (`tryFileLock`). */
+  readonly lock: LockIo;
 }
-/** Why there is no command: the step that found nothing it could check. */
-type CliNotLocatedReason = "caller" | "manifest" | "core" | "version" | "engine" | "bin" | "entry" | "interpreter" | "arguments" | "direction" | "no-registrations" | "not-registered";
-/** Why one registration of the product was not used. */
-type RegistrationRejection = "npx" | "arguments" | "no-file" | "no-package" | "version" | "engine" | "bin" | "entry";
-interface RegistrationNotUsed {
-  readonly client: string;
-  readonly path: string;
-  readonly name: string;
-  readonly why: RegistrationRejection;
+/** A version-1 record, as 0.13.0 wrote it: a send has no `kind`, and one `digest` stands for the content. */
+interface LegacyApprovalRecord {
+  approvalId: string;
+  /** Absent on a send. */
+  kind?: ApprovalKind | undefined;
+  digestVersion: 1;
+  inboxId: string;
+  inboxSub?: string | undefined;
+  draftId: string;
+  draftMessageId: string;
+  digest: string;
+  approvedDigest?: string | undefined;
+  approvedVia?: ApprovalChannel | undefined;
+  policy: SendPolicy;
+  requiredPolicy: SendPolicy;
+  riskFlags: string[];
+  expect: Expectation;
+  challengeHash?: string | undefined;
+  challengeAttempts: number;
+  state: ApprovalState;
+  createdAt: string;
+  expiresAt: string;
+  updatedAt: string;
+  sentMessageId?: string | undefined;
+  reason?: string | undefined;
+  change?: ChangeBinding | undefined;
+  download?: DownloadBinding | undefined;
 }
 /**
- * No command: nothing to run, and a sentence naming the product, its package and the exact version it needs. An
- * installation that has gone or changed since is said so, never replaced by a suite command found by name on PATH.
+ * A version-1 record as every surface shows it: `{ approvalId, kind, state, legacy: true, createdAt, expiresAt }` and
+ * the summary a version-2 record shows — its owner, what it was for, and which channel made it when that can be told.
+ * Never claimable, and never given a version-2 timestamp it does not hold.
  */
-interface CliCommandNotLocated {
-  readonly ok: false;
-  readonly reason: CliNotLocatedReason;
-  /** How the product is named to a person: `Gmail`. */
-  readonly product: string;
-  readonly package: string;
-  /** The exact version needed: the printing package's own, since the suite is released together. */
-  readonly version: string;
-  /** For `engine`: the Node range the target declares. */
-  readonly nodeRange?: string | undefined;
-  /** For another product: each registration of it that was looked at, and why it was not used. */
-  readonly registrations?: readonly RegistrationNotUsed[] | undefined;
-  /** What was found, in a clause. */
-  readonly detail: string;
-  /** The whole sentence to show. */
-  readonly message: string;
+interface LegacyView {
+  readonly approvalId: string;
+  readonly kind: ApprovalKind;
+  /** Derived as 0.13.0 derived it (`deriveLegacyV1State`). */
+  readonly state: ApprovalState;
+  readonly legacy: true;
+  readonly createdAt: string;
+  readonly expiresAt: string;
+  /** The stored owner, trusted as stored: a version-1 record has no binding to check it against. */
+  readonly inboxId: string;
+  readonly ownerScope: "owner" | "global";
+  /**
+   * The channel that made it, when only one could have: an `ibx_` owner is a Gmail mailbox, an `acc_` owner the
+   * stored platform of an account that still exists. Null when nothing says — it then takes part in no channel's
+   * grouping and gets only generic wording.
+   */
+  readonly channel: string | null;
+  readonly expect: Expectation;
+  readonly reason?: string | undefined;
+  readonly sentMessageId?: string | undefined;
 }
 //#endregion
-//#region src/handoff-text.d.ts
+//#region src/audit.d.ts
 /**
- * A handoff as words a person reads, and what a core function that prints one is given (CUE-403; CONTRIBUTING.md,
- * "Telling a person what to run"). `handoffs.ts` makes located handoffs and re-exports all of this.
- *
- * Kept apart from the locator on purpose: the configuration store, the secret stores and the attachment jail print
- * handoffs too, and the locator's own imports reach the configuration store, so importing it from them would be a
- * cycle. Nothing here locates anything or imports a module that does: a located command is made by `handoffs.ts` and
- * handed in, and what is here only renders one. With none handed in, there is nothing to render: a package that did not
- * give core its caller and is asked for a command has a programming error, not a bare name to fall back on.
+ * Every mailbox write leaves one line here: what was done, to which inbox, with which ids and outcome. Never message
+ * bodies, never secrets — recipient *domains* only, so the log can be shared when asking for help.
  */
-/** A command for a person to run, located, or the sentence saying why there is none here. */
-type Handoff = PrintedCommand | CliCommandNotLocated;
-interface HandoffUse {
-  /** The suite folders the command reads or writes; the four every command opens when left out. */
-  readonly uses?: readonly PathName[] | undefined;
-  /** It also reads or writes downloads, so the downloads folder is pinned too. */
-  readonly downloads?: boolean | undefined;
-}
-/**
- * The commands a package tells a person to run, made once per printing process from its caller (`handoffs.ts`,
- * `cliHandoffs`): `openCore({ caller })` puts them on `core.handoffs`. Each method takes the CLI's own words, never the
- * program, and returns a `Handoff`.
- */
-interface CliHandoffs {
-  /** The printing package: one of its own modules and its name. */
-  readonly caller: CliCommandCaller;
-  /** The shell the commands are quoted for. */
-  readonly platform: NodeJS.Platform;
-  /** The printing package's own CLI, with these words after the program. */
-  own(words: readonly string[], use?: HandoffUse): Handoff;
-  /** The core CLI: the printing package's own when that is core, the core it has installed otherwise. */
-  core(words: readonly string[], use?: HandoffUse): Handoff;
-  /** The CLI of `channel` — `core`, `gmail`, `slack` …: own, core, or another product found among its registrations. */
-  of(channel: string, words: readonly string[], use?: HandoffUse): Handoff;
-  /** The same commands, quoted for another shell. */
-  on(platform: NodeJS.Platform): CliHandoffs;
-  /**
-   * The same, able to find another product: with the servers registered with this machine's MCP clients read now, from
-   * the environment these were made with. Read once per call; nothing a registration names is run.
-   */
-  registered(): Promise<CliHandoffs>;
-  /** The same, finding another product among these registrations: a scan the caller has already read. */
-  withRegistrations(registrations: readonly RegisteredServer[]): CliHandoffs;
-}
-type SendPolicy = "chat" | "confirm" | "never";
-/**
- * How a loosening of the configuration is approved: `chat` — the person says yes in the conversation and the agent
- * claims the approval — or `confirm` — the person types a code at a terminal, as for a send under `confirm`.
- *
- * There is no `never`. A setting the software refused ever to loosen would leave editing the file by hand as the only
- * way to change it, and that passes no gate at all.
- */
-type ChangePolicy = "chat" | "confirm";
-/** 0.18's switch for the daily update check: what `defaults.updates` reads from until a level is set. */
-type UpdateCheckSetting = "on" | "off";
-type StoreKind = "keychain" | "file";
-interface ClientConfig {
-  provider: string;
-  clientId: string;
-  projectId?: string | undefined;
-  secretRef: string;
-  addedAt: string;
-  /**
-   * The organisation profile that made this row and owns it (design 2026-10-02 §D4) — absent on a row a person
-   * registered, or one a profile adopted. A row carrying it is the profile's to change: `org update` and `org remove`
-   * change it, and `client add --replace` and `client remove` refuse it while its organisation has a record.
-   *
-   * Additive: client rows are loose, so a release that does not know the key keeps it through its writes.
-   */
-  organisation?: string | undefined;
-}
-interface InboxConfig {
-  /** Immutable id (`ibx_` + 16 base32 characters). Secrets and all state are keyed by it; the alias is a label. */
-  id: string;
-  provider: string;
-  email: string;
-  /** Stable account id (OIDC `sub`). Absent for inboxes imported from tools that never asked for it. */
-  sub?: string | undefined;
-  identity: "oidc" | "legacy";
-  client: string;
-  tier: string;
-  contacts: boolean;
-  grantedScopes: string[];
-  secretRef: string;
-  sendPolicy?: SendPolicy | undefined;
-  /** Overrides `defaults.changePolicy` for changes to this inbox. */
-  changePolicy?: ChangePolicy | undefined;
-  internalDomains: string[];
-  createdAt: string;
-}
-interface Defaults {
-  sendPolicy: SendPolicy;
-  /**
-   * How a loosening is approved wherever an inbox or account does not say otherwise. Absent reads as `chat`.
-   *
-   * Absent rather than filled in by the schema, unlike `sendPolicy`. A config written before this setting existed
-   * reads as `chat` from then on, and the release note says so; a default the schema supplied would be written into
-   * the file by the next unrelated change, where it would look like a choice somebody made.
-   */
-  changePolicy?: ChangePolicy | undefined;
-  riskEscalation: boolean;
-  sendCaps: {
-    perHour: number;
-    perDay: number;
-  };
-  attachRoots: string[];
-  /** Extra deny entries on top of the built-in list. */
-  attachDeny: string[];
-  downloadsDir?: string | undefined;
-  timezone: string;
-  confirm: {
-    /**
-     * Fail-closed allowlist of MCP `clientInfo.name` values whose form elicitation is trusted to reach a human.
-     * Empty by default; only the CLI adds entries, after a probe.
-     */
-    elicitationClients: string[];
-  };
-  /**
-   * The daily update check (design 2026-09-28): once a day this machine asks npm whether a newer release is out, and
-   * every server and command stops until it is updated or put off until tomorrow. Absent reads as `on`.
-   *
-   * Absent rather than filled in, as `changePolicy` is: a default the schema supplied would be written into the file
-   * by the next unrelated change, where it would look like a choice somebody made. Turning it off is a loosening —
-   * it is what keeps a machine from quietly falling behind a release — so it is approved like one; on applies at once.
-   */
-  updateCheck?: UpdateCheckSetting | undefined;
-  /**
-   * How this machine updates (design 2026-10-16, U2): `auto`, `every-14-days` or `never`. Absent reads from
-   * `updateCheck` — `on` as `auto`, `off` as `never` — and both absent as `auto`. A word this release does not know
-   * reads as `auto`, and the file stays readable: a later release may add a level.
-   *
-   * Moving to a level that updates less is a loosening, approved like one; moving back applies at once. Every write of
-   * a level writes `updateCheck` beside it, `off` for `never` and `on` otherwise, so a release before 0.20 sharing the
-   * file checks, or does not, as the person chose.
-   */
-  updates?: string | undefined;
-}
-/**
- * A connected account on a platform that is not mail: a Slack workspace, and every channel after it (design
- * 2026-09-26) — one generic record, whatever the platform.
- *
- * `id`, `platform`, `workspace` (the container: a Slack team, a Resend team, a WhatsApp store), `userId` (who it acts
- * as), `tier`, `mode`, `grantedScopes`, `secretRef`, the two policies and `createdAt` are every channel's. A channel
- * may keep keys of its own beside them — Slack's `appId`, `redirectPort` — and they are kept through every write. It
- * may not add a safety setting: only `sendPolicy`, `changePolicy` and `mode` are judged by `classifyChange`, so a key
- * of a channel's own that loosened something would loosen it unasked.
- *
- * `secretRef` stays required, although the 2026-09-26 contract made it optional for a channel with no credential:
- * every earlier release requires it, and they share this file — an account without one would make the whole
- * configuration unreadable to a server started last week. Such a channel records a reference that names no secret,
- * `<platform>:none:<id>`, until a config version can say otherwise.
- *
- * It sits beside `inboxes` rather than replacing it. The spec asked for one `accounts` map holding everything, and
- * that rename is the one change this file cannot take: `version: 1` is additive precisely because an MCP server
- * started last week and a CLI run today share the file, and a release that moved every mailbox out of `inboxes`
- * would read, to the older of the two, as a config with no mailboxes in it. What the rename was for — one list of
- * everything connected, whatever the platform — is a question about the shape of the answer, not the shape of the
- * file, so `connectedAccounts()` provides it and the file grows one key.
- */
-interface AccountConfig {
-  id: string;
-  /** `slack`. */
-  platform: string;
-  /** The workspace or team id. Every other id this account sees is only meaningful inside it. */
-  workspace: string;
-  /** "Acme Corp" — shown to people, never matched on: a workspace can be renamed and stays the same workspace. */
-  workspaceName?: string | undefined;
-  /** This account's own user id in that workspace, so its own messages can be told from everyone else's. */
-  userId: string;
-  tier: string;
-  grantedScopes: string[];
-  /** Where its credential is in the secret store, `<platform>:…` — for a channel that stores none, `<platform>:none:<id>`. */
-  secretRef: string;
-  sendPolicy?: SendPolicy | undefined;
-  /** Overrides `defaults.changePolicy` for changes to this account. */
-  changePolicy?: ChangePolicy | undefined;
-  createdAt: string;
-  /**
-   * The OAuth client this account's token was issued by, and the app it belongs to.
-   *
-   * Recorded because the Gmail release found the opposite: a reauth used the first OAuth client in the config
-   * rather than the inbox's own, and then did not record which one it had used. Slack makes that worse — D8
-   * means **one app per workspace**, so "the first app" is wrong more often than it is right — and a reauth
-   * that silently moves an account onto a different app changes what it can do without saying so.
-   *
-   * Optional because the key is additive: a config written before these existed parses unchanged.
-   */
-  oauthClientId?: string | undefined;
-  appId?: string | undefined;
-  /**
-   * `read` or `send`, as installed.
-   *
-   * Kept beside `grantedScopes` rather than derived from them, because the two answer different questions: the
-   * scopes are what Slack granted, and this is what the person asked for. A disagreement between them is drift
-   * worth reporting, and a value derived from the scopes could never disagree.
-   */
-  mode?: string | undefined;
-  /**
-   * The loopback port the last sign-in used, which is the one in the app's redirect URL.
-   *
-   * Slack matches redirect URLs exactly, so every later sign-in and every set of steps that edits the app has to
-   * name this number. Without it the steps said `<port>`, or — from the MCP server — guessed 51234, and a person who
-   * had chosen another port followed them to a sign-in that failed on the way back.
-   */
-  redirectPort?: number | undefined;
-  /** The organisation profile whose Slack app created this account. Absent for a person's own app. */
-  organisation?: string | undefined;
-  /** Which app in that profile issued the account's current credential. */
-  profileApp?: "read" | "send" | undefined;
-}
-type PendingRevocationStatus = "pending" | "revoked" | "expired";
-/** One bearer token in a superseded rotating bundle, tracked independently from its pair. */
-interface PendingRevocationTokenState {
-  status: PendingRevocationStatus;
-  /** The fixed absolute time after which the old token is known to be unusable. */
-  deadline: string;
-}
-/**
- * A superseded credential kept until each token in it is conclusively revoked or expired.
- *
- * `store` belongs to the entry rather than being inferred from `secrets.store`: an older release can move the root
- * store without knowing to move this bundle, and cleanup must still find the only copy that exists.
- */
-interface PendingRevocation {
-  ref: string;
-  store: StoreKind;
-  platform: string;
-  workspace: string;
-  createdAt: string;
-  tokens: {
-    access: PendingRevocationTokenState;
-    refresh?: PendingRevocationTokenState | undefined;
-  };
-}
-interface ConfigBody {
-  /**
-   * The one secret backend for this config directory: client secrets, refresh tokens and the approval key. Absent
-   * until the first command that stores a secret chooses it.
-   */
-  secrets?: {
-    store: StoreKind;
-  } | undefined;
-  clients: Record<string, ClientConfig>;
-  inboxes: Record<string, InboxConfig>;
-  /** Non-mail accounts. Absent in every config written before this key existed, hence the default. */
-  accounts: Record<string, AccountConfig>;
-  /** Superseded rotating credentials which still need conclusive per-token cleanup. */
-  pendingRevocations?: PendingRevocation[] | undefined;
-  defaults: Defaults;
-  /**
-   * How what an agent sends is labelled (design 2026-10-15-agent-label, L5): the word, the name, the rules that say
-   * who a message appears to come from, and each Slack account's agent emoji.
-   *
-   * `unknown` here, on purpose: it is read only through `agentLabelOf`, which reads a value it does not understand
-   * as the stricter one — an unknown word as `agent`, a rule list it cannot read as no rules — so a hand edit or a
-   * later release's key can only tighten. Kept through every write as the schemas keep every key they do not name, and
-   * judged by `classifyChange`.
-   */
-  agentLabel?: unknown;
-}
-interface ConfigV1 extends ConfigBody {
-  version: 1;
-}
-/** A name an account used to have, and the account that had it. */
-interface FormerName {
-  /** What it was renamed to — at the time. The account's current name is found by `id`, so a later rename is followed. */
-  name: string;
-  id: string;
-}
-/**
- * Names that were replaced, per kind, and never reusable.
- *
- * Per kind because version 1 lets a mailbox and a workspace share a word: `work` the mailbox and `work` the workspace
- * become `work/gmail` and `work/slack`, and one flat record could not say which old `work` is which.
- */
-interface FormerNames {
-  inboxes: Record<string, FormerName>;
-  accounts: Record<string, FormerName>;
-}
-/** Who an organisation's Google client is for, as its administrator states it (design 2026-10-02 §D2). */
-type OrganisationServes = "any" | {
-  domains: string[];
-};
-/**
- * One Google client an organisation profile brought here: a *generation* (design 2026-10-02 §D4).
- *
- * `owned` — the profile made the client row `name` (`rgc-1`), which carries `organisation`, and its secret is the
- * profile's to rewrite. `adopted` — the row was already here under a name a person chose (they ran `client add` with
- * the organisation's file), and stays theirs: no `org` command changes or removes it. `serves` is per generation,
- * because it is a fact about one client, not about the organisation.
- */
-interface OrganisationGeneration {
-  name: string;
-  clientId: string;
-  projectId?: string | undefined;
-  ownership: "owned" | "adopted";
-  serves: OrganisationServes;
-  addedAt: string;
-}
-interface OrganisationSlackApp {
-  clientId: string;
-  appId?: string | undefined;
-}
-/**
- * An organisation's update caps, as the file beside its profile names them (design 2026-10-16, U8), and the SHA-256 of
- * that file, so `org update` can tell the organisation changing them from the record drifting. A `max` word this release
- * does not know reads as `never`, the strictest it could mean: caps only ever tighten.
- */
-interface OrganisationUpdates {
-  max?: string | undefined;
-  background?: boolean | undefined;
-  sha256: string;
-}
-/**
- * The organisation's bot-only agent app, as its profile's agent-app file names it (CUE-493): the app's id, and the
- * SHA-256 of that file, so `org update` can tell the organisation changing it from the record drifting. No client id:
- * nobody signs in through it — its administrator installs it once and its members paste its bot token.
- */
-interface OrganisationAgentApp {
-  appId: string;
-  sha256: string;
-}
-/**
- * What this machine records of one organisation profile: never its bytes and never its secret — where it was read
- * from, the SHA-256 of what was read and when, the generations of its Google client, and its Slack apps.
- */
-interface OrganisationRecord {
-  label: string;
-  /** Read again, from this absolute path, by every `org update`. `file` is the one kind version 1 knows (§D3). */
-  source: {
-    kind: string;
-    path: string;
-  };
-  sha256: string;
-  readAt: string;
-  addedAt: string;
-  /** Whether the member asked for this organisation's client to serve addresses outside it too (§D6). */
-  forOtherAddresses: boolean;
-  /** `active` names the generation new mailboxes get — none once a profile stops naming a Google client. */
-  gmail?: {
-    active: string | null;
-    generations: OrganisationGeneration[];
-  } | undefined;
-  slack?: {
-    workspace: string;
-    workspaceName: string;
-    redirectPort: number;
-    apps: {
-      read?: OrganisationSlackApp | undefined;
-      send?: OrganisationSlackApp | undefined;
-      agent?: OrganisationAgentApp | undefined;
-    };
-  } | undefined;
-  /** The organisation's update caps, from the file beside its profile; absent when it names none. */
-  updates?: OrganisationUpdates | undefined;
+interface AuditRecord {
+  at: string;
+  /** Immutable inbox id; `alias` is the label at the time. */
+  inboxId: string;
+  alias?: string;
+  operation: string;
+  /** `started` marks the first half of a change recorded before it is made; a later record for the same ids ends it. */
+  outcome: "ok" | "refused" | "failed" | "started";
+  ids?: Record<string, string | string[] | CondensedIds>;
+  recipientDomains?: string[];
   /**
-   * The entries of the profile's `extensions` this release did not know and skipped, being optional (design 2026-10-19,
-   * X3): the release that first understands each, and the SHA-256 of the entry's canonical JSON — as
-   * `Record<string, OrganisationIgnoredExtension>`. Kept in step with the profile. Absent when none was skipped.
-   *
-   * Held as the file holds it, whatever its shape, and read only through `ignoredListOf`, which keeps the well-formed
-   * entries and names the rest: 0.21.0 is the first release to read it, so a shape a later release or a hand gave it
-   * must never make the whole configuration unreadable, nor be dropped by an unrelated write. Losing it is safe: a
-   * later release that understands an entry judges applying it by its classifier whether or not the list names it —
-   * a tightening at once, anything else approved first, never a repair of drift (X4).
+   * Full canonical recipient addresses. Only a send writes these: for every other operation the domains are enough,
+   * and storing less is better — but when mail has actually left, "who did it go to" is the first question anyone
+   * asks afterwards, and a domain does not answer it.
    */
-  ignoredExtensions?: unknown;
-}
-interface ConfigV2 extends ConfigBody {
-  version: 2;
-  formerNames: FormerNames;
+  recipients?: string[];
+  approvalId?: string;
+  reason?: string;
+  /** The process that performed the work; daemon work keeps its caller separately in `origin`. */
+  surface?: "cli" | "mcp" | "app" | "daemon";
+  /** The requesting client surface; autonomous work is `daemon`/`daemon`. */
+  origin?: "cli" | "mcp" | "app" | "daemon";
   /**
-   * The organisation profiles added here, by organisation word (design 2026-10-02 §D4). Absent reads as none, and
-   * stays absent until the first `org add`: a key the schema filled in would be written into every file by the next
-   * unrelated change.
+   * The policy that decided how this was approved. Written by change approvals, where it is the whole question
+   * afterwards: a loosening a person typed a code for and one an agent claimed after a yes in chat look the same in
+   * the configuration, and only this line tells them apart.
    */
-  organisations?: Record<string, OrganisationRecord> | undefined;
-}
-/** What a legacy drain records of one tracked record: still open, or what became of it. */
-type LegacyDrainOutcome = "revoked" | "expired" | "used" | "failed" | "sending" | "unknown";
-/**
- * The approvals an earlier release prepared that were still waiting, or already being sent, when this configuration
- * became version 3, and what has become of each (design 2026-10-05 §D1, "Old releases are locked out before the fence
- * is relied on").
- */
-interface LegacyDrain {
-  /** When the conversion that opened the drain was written. */
-  since: string;
+  policy?: SendPolicy;
   /**
-   * Every tracked version-1 send record by id: `open` until it has an outcome — or `sending` from the start, for one an
-   * earlier release was already sending when the conversion ran.
+   * What daily retention deleted (`operation: 'approval.retained'`, design 2026-10-05 §D9): the approval's kind, its
+   * final state, when it finished and any provider id — never its content or a recipient. Appended durably before the
+   * record is unlinked, so the audit log keeps the terminal history the approval directory no longer does.
    */
-  tracked: Record<string, "open" | LegacyDrainOutcome>;
+  retained?: RetainedApproval;
 }
-/** What version 3 adds to a body of either naming. */
-interface Version3Fields {
-  /** Each owner's send epoch by id; absent reads as 0. Raised by every write that turns its send policy to `never`. */
-  sendEpochs?: Record<string, number> | undefined;
-  /** Present while records from an earlier release are being retired. */
-  legacyDrain?: LegacyDrain | undefined;
+/** Large id lists are condensed so every audit line stays small enough to be appended atomically. */
+interface CondensedIds {
+  count: number;
+  sha256: string;
+  first: string[];
 }
-/** Version 3 over a version-1 body: one plain word per account. */
-interface ConfigV3Naming1 extends ConfigBody, Version3Fields {
-  version: 3;
-  naming: 1;
+declare class AuditLog {
+  #private;
+  readonly directory: string;
+  constructor(stateDir: string, now?: () => Date);
+  append(record: Omit<AuditRecord, "at"> & {
+    at?: string;
+  }, options?: {
+    durable?: boolean;
+  }): Promise<AuditRecord>;
+  /** The most recent records, newest last, optionally filtered by inbox and a lower time bound. */
+  tail(options?: {
+    limit?: number;
+    inbox?: string;
+    since?: string;
+  }): Promise<AuditRecord[]>;
 }
-/** Version 3 over a version-2 body: `organisation/platform` names, and the names they replaced. */
-interface ConfigV3Naming2 extends Omit<ConfigV2, "version">, Version3Fields {
-  version: 3;
-  naming: 2;
+/** The step of a batch that failed. */
+type MaintenanceStep = "lock" | "state" | "enumerate" | "stat" | "read" | "write" | "append" | "claim-unlink" | "record-unlink" | "lock-lost" | "cursor";
+/** A failure a batch met: which step, for which record, and the error's code — never anything a record holds. */
+interface MaintenanceError {
+  readonly step: MaintenanceStep;
+  readonly approvalId?: string | undefined;
+  readonly code: string;
 }
 /**
- * Version 3: the send epoch and the legacy drain (design 2026-10-05 §D1), over either naming — converted from version 1
- * or 2 without renaming anything, so its body keeps the rules of the version it came from.
+ * What one call of `ensurePruned` did. `attempted` — it ran a batch; when it did not, `skipped` says why: not due
+ * (a batch ran less than a day ago), busy (another process holds the maintenance lock), or no records (there is no
+ * approvals directory at all). `processed` counts the slots whose record work ran to its end, `pruned` the records
+ * deleted, `skippedBusy` the records whose lock was held elsewhere and were left. `complete` — the batch reached the end
+ * of the directory inside both bounds; hitting 200 slots or the deadline, or losing the lock, leaves it false.
  */
-type ConfigV3 = ConfigV3Naming1 | ConfigV3Naming2;
-type Config$1 = ConfigV1 | ConfigV2 | ConfigV3;
-/** A configuration whose accounts are named `organisation/platform`: version 2, or version 3 over it. */
-type NamedConfig = ConfigV2 | ConfigV3Naming2;
-/** A configuration whose accounts have one plain word each: version 1, or version 3 over it. */
-type PlainConfig = ConfigV1 | ConfigV3Naming1;
-/** The committed config returned by an update; process-only commit metadata is deliberately stored out of band. */
-type ConfigUpdateResult = Config$1;
-declare class ConfigStore {
-  #private;
-  readonly path: string;
-  /**
-   * @param options.handoffs the printing package's handoffs (`core.handoffs`, CUE-403), for the command a refusal
-   *   names; left out, a refusal that has to name one is a programming error (`requiredHandoffs`).
-   */
-  constructor(configDir: string, options?: {
-    readonly handoffs?: CliHandoffs | undefined;
-    /** Test-only pauses inside the version-3 conversion (`config-hooks.ts`); unreachable from the package root. */
-    readonly [CONVERSION_HOOKS]?: ConversionHooks | undefined;
-  });
-  /** The current config; an empty one when the file does not exist yet. */
-  load(): Promise<Config$1>;
-  /**
-   * Read-modify-write under a lock, so a CLI command and a running MCP server never lose each other's changes. The
-   * mutator receives a fresh copy read inside the lock and returns the new config, which is validated before writing.
-   */
-  update(mutator: (config: Config$1) => Config$1 | Promise<Config$1>, options?: {
-    consent?: LooseningConsent;
-    signal?: AbortSignal | undefined;
-  }): Promise<ConfigUpdateResult>;
-  /**
-   * The one way a version-1 config becomes version 2.
-   *
-   * Under the credentials lock and then the config lock — the order everything takes them in — so it cannot land
-   * between a removal's read and its write, or in the middle of moving secrets between backends.
-   *
-   * `expected` is the fingerprint of the config the caller previewed. The file is read again inside the locks, and
-   * if it is not that config any more the whole thing is refused: somebody confirmed a mapping computed from
-   * something else. Nothing waits for a person while holding a lock; the preview happens before this is called.
-   *
-   * `build` produces version 2 from the locked snapshot. What it may change is checked rather than trusted: the same
-   * accounts, byte for byte, under new keys — a rename grants nothing, so a build that changed anything else is a
-   * bug and is refused before it is written.
-   *
-   * Idempotent, but only for this plan. A retry after a write that committed — even one whose lock release then
-   * failed — finds version 2, recognises its own mapping in it, and says so. Version 2 that does *not* carry this
-   * mapping is somebody else's migration; saying "already migrated" there would report a mapping nobody applied,
-   * and a caller updating registrations from it would point them at names that do not exist.
-   *
-   * `rows` is the plan, and the question is asked of the mapping rather than of the whole file: between a
-   * committed write and its retry, something else may have changed a policy or a timezone, and a retry refused
-   * over that would be idempotency in name only. The rows are checked here rather than by whoever built them,
-   * for the same reason `build` is: a caller that could answer its own question could answer it wrongly.
-   *
-   * The file it replaces is copied beside it first — see `backUpBeforeMigration` — and the copy's path returned.
-   */
-  migrateNames(expected: string, rows: readonly RenamedAccount[], build: (current: PlainConfig) => NamedConfig): Promise<{
-    status: "migrated" | "already-migrated";
-    config: NamedConfig;
-    backup?: string;
-  }>;
+interface MaintenanceStatus {
+  readonly attempted: boolean;
+  readonly processed: number;
+  readonly pruned: number;
+  readonly skippedBusy: number;
+  readonly complete: boolean;
+  readonly errors: readonly MaintenanceError[];
+  readonly skipped?: "not-due" | "busy" | "no-records" | undefined;
+}
+/** What a batch reports of a record it is about to delete: never a body, an address, or anything a sender wrote. */
+interface RetainedApproval {
+  readonly kind: ApprovalKind;
+  readonly state: ApprovalState;
+  /** When it finished: its validated terminal time, or a legacy used record's safe `updatedAt`. */
+  readonly finishedAt: string;
+  /** A used send's provider id, when it has a non-empty one. */
+  readonly providerId?: string | undefined;
+  /** A record an earlier release wrote. */
+  readonly legacy?: true | undefined;
+}
+interface MaintenanceOptions {
   /**
-   * The one way a configuration becomes version 3 (design 2026-10-05 §D1, "Old releases are locked out before the
-   * fence is relied on").
-   *
-   * Version 3 carries the send epoch, which 0.13 does not know, and 0.13 refuses to read it — so from this write on, no
-   * 0.13 process can start a prepare, a claim, an approval or a policy change through this file. Nothing is renamed:
-   * a version-1 body stays version 1's (`naming: 1`) until the names migration, which needs its own approval.
-   *
-   * Under the config lock, the file is read again — never from the cache, never from the read before the lock — and an
-   * existing version 3 returned unchanged: a second converter that lost the race keeps the winner's epochs and drain.
-   * `scan` runs under the same lock, so a record written while this waited for it is seen, and an update cannot land
-   * between the scan and the write; the version-3 write carries `legacyDrain` only when the scan tracked something.
-   * With no config file at all there is nothing to convert, and nothing is written.
+   * When no further step may start, on the store's clock, in milliseconds: five seconds from the call when left out.
+   * A report passes the one deadline it shares with its own reads.
    */
-  convertToVersion3(scan: () => Promise<LegacyDrain["tracked"]>, options?: {
-    now?: (() => Date) | undefined;
-  }): Promise<{
-    status: "converted" | "already" | "empty";
-    config: Config$1;
-  }>;
+  readonly deadline?: number | undefined;
+}
+//#endregion
+//#region src/approval-validate.d.ts
+/**
+ * The integrity check of a version-2 approval record (design 2026-10-05 §D1, "Digest integrity" and "Version-2
+ * timestamps fail closed"). Pure: it reads the record and the id its file is named by, and decides.
+ *
+ * A record either passes, or is `corrupt` for one fixed reason — never a sentence built from the record, so nothing a
+ * file holds is ever echoed — and of one of two attribution classes. `verified`: its `bindingDigest` recomputes, so its
+ * owner and identity can be trusted and it is corrupt for another reason (a state, a timestamp, its evidence).
+ * `unverifiable`: its binding is missing, malformed or does not match, or it sits in another record's file, so nothing
+ * it says about whom it belongs to can be trusted.
+ *
+ * Nothing here is wired into a read yet; the store's decoder does that.
+ */
+/** Why a version-2 record is corrupt: a fixed category, never the record's own words. */
+type IntegrityReason = "file-name-mismatch" | "binding-missing" | "binding-malformed" | "binding-mismatch" | "wrong-shape" | "digest-version" | "content-digest-malformed" | "content-digest-mismatch" | "identity-contradiction" | "listing-mismatch" | "narrowing-invalid" | "state-impossible" | "lifetime-mismatch" | "timestamp-invalid" | "timestamp-missing" | "timestamp-misplaced" | "timestamp-misordered" | "sent-id-missing" | "evidence-missing" | "evidence-invalid" | "evidence-contradictory";
+type Attribution = "verified" | "unverifiable";
+type ErrorCode = "UNEXPECTED" | "APPROVAL_REQUIRED" | "APPROVAL_PENDING" | "APPROVAL_EXPIRED" | "APPROVAL_VOID" | "SEND_OUTCOME_UNKNOWN" | "SEND_REFUSED" | "POLICY_NEVER" | "ACT_NOT_ALLOWED" | "STANDING_REFUSED" | "STANDING_LIMIT" | "RATE_CAPPED" | "UNSENDABLE_HTML" | "LOOSENING_REFUSED" | "NEEDS_NEWER_RELEASE" | "USAGE" | "CURSOR_MISMATCH" | "BAD_DATA" | "REPLY_INVALID" | "NOT_FOUND" | "PROVIDER_UNAVAILABLE" | "SOURCE_UNAVAILABLE" | "SECRET_STORE_UNAVAILABLE" | "TRANSIENT" | "KEYCHAIN_APPROVAL_PENDING" | "LOCK_TIMEOUT" | "AUTH_REQUIRED" | "SCOPE_MISSING" | "WHATSAPP_VISIBILITY_SEAM_REQUIRED" | "CONFIG";
+interface CommsErrorOptions {
+  hint?: string;
+  details?: Record<string, unknown>;
+  cause?: unknown;
 }
-/** One account's rename, as the migration planned it. */
-interface RenamedAccount {
-  readonly kind: "inbox" | "account";
-  readonly from: string;
-  readonly to: string;
-  readonly id: string;
+declare class CommsError extends Error {
+  readonly code: ErrorCode;
+  readonly hint: string | undefined;
+  readonly details: Record<string, unknown> | undefined;
+  constructor(code: ErrorCode, message: string, options?: CommsErrorOptions);
+  get exitCode(): number;
+  get retryable(): boolean;
 }
-/** A value a loosened setting had or will have: a policy, a mode, a list, a pair of caps, a path, or nothing. */
-type SettingValue = string | number | boolean | readonly string[] | {
-  readonly [key: string]: unknown;
-} | null;
+//#endregion
+//#region src/approval-stored.d.ts
 /**
- * One loosened setting, with the values the classifier compared.
+ * Every approval file, read one way (design 2026-10-05 §D2, "Legacy version-1 records, one decoder everywhere" and
+ * "Two classes of parseable corrupt record").
  *
- * The values are the ones it judged, not the raw fields: an inbox that inherits a looser default reports the policy
- * it inherits, and a new inbox reports the default it was measured against. A preview built from anything else could
- * show a person one change while the classifier judged another.
+ * A file is one of four things, and every read says which:
+ *
+ * - `v2` — a version-2 record that passed `validateV2`: the only form anything may act on;
+ * - `legacy` — a structurally valid version-1 record, read by its own release's rules: reported, never claimed;
+ * - `corrupt` — a parseable version-2 record that failed its integrity check, attributable to its owner or not;
+ * - `unreadable` — a file that cannot safely be read at all: shown only as a stub naming its id (from the file name)
+ *   and a fixed reason, never anything the file holds.
+ *
+ * Nothing is silently omitted, and the decoder writes nothing.
  */
-interface Loosening {
-  /** As `ConfigStore.update` names it in a refusal: `accounts.rgc/slack.mode`, `defaults.sendPolicy`. */
-  readonly path: string;
-  readonly before: SettingValue;
-  readonly after: SettingValue;
-  /**
-   * The inbox or account measured on the before side, by id. Absent for one new in this change and for a setting
-   * that belongs to the whole configuration. Carried so that an approval of this loosening cannot be spent on a
-   * different account that took the same name in the meantime.
-   */
-  readonly id?: string | undefined;
+/** Why a file cannot safely be read: a fixed category, never the file's own bytes. */
+type UnreadableReason = "invalid-json" | "truncated" | "missing-ownership" | "missing-kind" | "wrong-shape" | "file-name-mismatch";
+/** What may be said of a record that cannot be trusted: its id, that it is corrupt, and why — nothing else. */
+interface CorruptStub {
+  readonly approvalId: string;
+  readonly state: "corrupt";
+  readonly reason: UnreadableReason | IntegrityReason;
+}
+/** What an attribution-verified corrupt record may still show its owner: the fields its binding was made over. */
+interface OrdinarySafeFields {
+  readonly kind: ApprovalKind;
+  readonly channel: string;
+  readonly ownerScope: OwnerScope;
+  readonly inboxId: string;
+  readonly inboxSub?: string | undefined;
+  readonly draftId: string;
+  readonly draftMessageId: string;
+  readonly expect: Expectation;
+}
+/** A disclosure record has no channel owner or sender-controlled operational fields to expose. */
+interface DisclosureSafeFields {
+  readonly kind: "disclosure";
 }
+type SafeFields = OrdinarySafeFields | DisclosureSafeFields;
+type StoredApproval = {
+  readonly form: "v2";
+  readonly record: ApprovalRecord;
+} | {
+  readonly form: "legacy";
+  readonly view: LegacyView;
+  readonly record: LegacyApprovalRecord;
+} | {
+  readonly form: "corrupt";
+  readonly approvalId: string;
+  readonly reason: IntegrityReason;
+  readonly attribution: Attribution;
+  /** Only when attribution is verified. */
+  readonly safe: SafeFields | null;
+} | {
+  readonly form: "unreadable";
+  readonly stub: CorruptStub;
+};
+//#endregion
+//#region src/approval-outcome.d.ts
 /**
- * One setting a change writes, from the value in the file before to the value after — whichever way it moves.
+ * One locked classification of every record into an outcome (design 2026-10-05 §D2).
  *
- * Unlike a `Loosening`, these are the raw values, not the effective ones: `null` for a setting the file does not
- * hold, so a mailbox set to `chat` itself is told apart from one inheriting `chat`, which only the first survives a
- * later change to the default. `id` is the inbox or account measured on the before side, as for a loosening.
+ * `approvalOutcome` says what a record is now — its state, whether it can be claimed, and what an action on it would be
+ * told — from the record as it was read under its own lock and the configuration read in that same lock (`LiveGate`).
+ * Nothing here reads a file or a clock of its own, and nothing here writes: the store persists what the outcome
+ * derives, and only from inside the lock it was classified under.
  */
-interface SettingChange {
-  readonly path: string;
-  readonly before: SettingValue;
-  readonly after: SettingValue;
-  readonly id?: string | undefined;
-}
+/** What is being done with the record: an approval, a claim, a wait, a revoke, or a look. */
+type OutcomeAction = "approve" | "claim" | "wait" | "revoke" | "inspect";
+/** A record's state as anyone may be told it: a download's answered question says `answered`. */
+type PublicApprovalState = ApprovalState | "corrupt" | "answered";
 /**
- * Proof that exactly these paths may loosen: produced by a CLI after a person at a terminal typed a challenge, or by
- * `claimChange` from a change approval a person gave.
+ * Where an approval stands, as every surface may show it (design 2026-10-05 §D8): its id, kind, channel, state and
+ * whether it can be claimed, with the timestamps its state carries. Never a challenge hash, and nothing a sender wrote.
  */
-interface LooseningConsent {
-  kind: "loosening-consent";
-  paths: readonly string[];
+interface ApprovalObject {
+  readonly id: string;
+  readonly kind: ApprovalKind | null;
+  readonly channel: string | null;
+  readonly state: PublicApprovalState;
+  readonly claimable: boolean;
+  readonly route?: ApprovalRoute | undefined;
+  readonly ownerRemoved?: true | undefined;
+  /** A record from an earlier release, read by its own rules: shown, never claimed. */
+  readonly legacy?: true | undefined;
+  readonly reason?: string | undefined;
+  readonly createdAt?: string | undefined;
+  readonly expiresAt?: string | undefined;
+  readonly approvedAt?: string | undefined;
+  readonly usableUntil?: string | undefined;
+  readonly sendingAt?: string | undefined;
+  readonly sendingHeartbeatAt?: string | undefined;
+  /** When a `sending` record reads `unknown` (`unknownAtOf`): derived, never stored. Also on an `unknown` one. */
+  readonly unknownAt?: string | undefined;
+  readonly usedAt?: string | undefined;
+  readonly sentAt?: string | undefined;
+  readonly sentMessageId?: string | undefined;
+  readonly failedAt?: string | undefined;
+  readonly revokedAt?: string | undefined;
+  readonly expiredAt?: string | undefined;
+}
+/** What an action on a record is, now. */
+interface ApprovalOutcome {
+  readonly state: PublicApprovalState;
+  readonly claimable: boolean;
+  readonly ownerRemoved?: true | undefined;
+  readonly reason?: string | undefined;
   /**
-   * What each path was approved to move between, when the consent came from a change approval.
-   *
-   * A terminal challenge is answered moments before the write it permits, so the paths are enough. An approval is
-   * prepared first and applied later — after a sign-in, possibly minutes later — and in between the configuration
-   * can move underneath it: the same path, loosened from a different value, or on a different account that took
-   * the name. With these, `ConfigStore.update` refuses any loosening that is not exactly one of them.
+   * A version-2 record as this classification reads it: with a revocation it derived applied (an owner removed, a
+   * stale send epoch, or — for a claim or an approval — a live `never`). Null for every other form.
    */
-  changes?: readonly Loosening[] | undefined;
+  readonly record: ApprovalRecord | null;
+  /** Whether `record` carries a revocation the classification derived, for a locked action to persist. */
+  readonly revokes: boolean;
+  /** Where it stands, as D8 shows it (`publicApproval`). */
+  readonly approval: ApprovalObject;
+  /** What the action is refused with, when it is refused by the record's state alone. */
+  readonly error?: CommsError | undefined;
 }
+/**
+ * What became of a used send, in the words of the surface that says it, from the time the provider accepted it (D2's
+ * used-send row): Gmail and Slack, where acceptance is sending, say it was "sent at …"; Resend's own surfaces that it
+ * was "accepted by Resend at …"; core's generic surfaces "accepted by <provider> at …".
+ */
+type UsedSaid = (usedAt: string) => string;
 //#endregion
-//#region src/approval-binding.d.ts
+//#region src/handoff-text.d.ts
 /**
- * What a version-2 approval binds, defined once (design 2026-10-05 §D1, "Digest integrity").
- *
- * A record stores two digests. `contentDigest` is the outward content or change, computed as before: the message, the
- * change, the download. `bindingDigest` is this module's: the content digest together with the record's route, its
- * lifetimes and its own identity — who it belongs to, which draft, which channel, which send epoch. Every one of those
- * is a field a claim or a report acts on, so a record whose binding no longer recomputes from its own fields has been
- * altered since it was made, and nothing it says can be trusted.
+ * A handoff as words a person reads, and what a core function that prints one is given (CUE-403; CONTRIBUTING.md,
+ * "Telling a person what to run"). `handoffs.ts` makes located handoffs and re-exports all of this.
  *
- * There is no second copy of anything: the binding is recomputed from the stored fields alone, never stored apart
- * from them as a key.
+ * Kept apart from the locator on purpose: the configuration store, the secret stores and the attachment jail print
+ * handoffs too, and the locator's own imports reach the configuration store, so importing it from them would be a
+ * cycle. Nothing here locates anything or imports a module that does: a located command is made by `handoffs.ts` and
+ * handed in, and what is here only renders one. With none handed in, there is nothing to render: a package that did not
+ * give core its caller and is asked for a command has a programming error, not a bare name to fall back on.
  */
+/** A command for a person to run, located, or the sentence saying why there is none here. */
+type Handoff = PrintedCommand | CliCommandNotLocated;
+interface HandoffUse {
+  /** The suite folders the command reads or writes; the four every command opens when left out. */
+  readonly uses?: readonly PathName[] | undefined;
+  /** It also reads or writes downloads, so the downloads folder is pinned too. */
+  readonly downloads?: boolean | undefined;
+}
 /**
- * How an approval is decided, fixed when it is made: `chat` — a yes in the conversation is enough — or `confirm` — a
- * person outside the chat decides. A send's route is the stricter of its live send policy and any escalation; a
- * change's is the live change policy. It never changes when the configuration does.
+ * The commands a package tells a person to run, made once per printing process from its caller (`handoffs.ts`,
+ * `cliHandoffs`): `openCore({ caller })` puts them on `core.handoffs`. Each method takes the CLI's own words, never the
+ * program, and returns a `Handoff`.
  */
-type ApprovalRoute = "chat" | "confirm";
-/** The four activation documents that may receive standing disclosure authority. */
-type DisclosureActivationKind = "rule" | "judge-budget" | "judge-kind" | "enable-all";
-/** An immutable version named by a standing disclosure authorisation. */
-type DisclosureVersionKind = "rule" | "target" | "subscriber" | "judge" | "judge-budget" | "judge-kind";
-interface DisclosureVersion {
-  readonly kind: DisclosureVersionKind;
-  readonly id: string;
-  readonly version: number;
+interface CliHandoffs {
+  /** The printing package: one of its own modules and its name. */
+  readonly caller: CliCommandCaller;
+  /** The shell the commands are quoted for. */
+  readonly platform: NodeJS.Platform;
+  /** The printing package's own CLI, with these words after the program. */
+  own(words: readonly string[], use?: HandoffUse): Handoff;
+  /** The core CLI: the printing package's own when that is core, the core it has installed otherwise. */
+  core(words: readonly string[], use?: HandoffUse): Handoff;
+  /** The CLI of `channel` — `core`, `gmail`, `slack` …: own, core, or another product found among its registrations. */
+  of(channel: string, words: readonly string[], use?: HandoffUse): Handoff;
+  /** The same commands, quoted for another shell. */
+  on(platform: NodeJS.Platform): CliHandoffs;
+  /**
+   * The same, able to find another product: with the servers registered with this machine's MCP clients read now, from
+   * the environment these were made with. Read once per call; nothing a registration names is run.
+   */
+  registered(): Promise<CliHandoffs>;
+  /** The same, finding another product among these registrations: a scan the caller has already read. */
+  withRegistrations(registrations: readonly RegisteredServer[]): CliHandoffs;
 }
 /**
- * The content-free, canonical authority for a future disclosure (local-event design D2).
- *
- * The event daemon derives this from one canonical activation document. Core does not construct
- * that document; it verifies the closed shape that makes an independently supplied version list
- * impossible to smuggle into a disclosure record.
+ * Why a saved name has {@link DOWNLOAD_SUFFIX} after it: a name tools read or run on their own (`auto-read`), an
+ * extension that is not one of the inert ones (`type`), or no extension at all (`no-extension`).
  */
-interface DisclosureBinding {
-  readonly digest: string;
-  readonly activationIntentId: string;
-  readonly activationKind: DisclosureActivationKind;
-  readonly versions: readonly DisclosureVersion[];
+type RenameReason = "auto-read" | "type" | "no-extension";
+//#endregion
+//#region src/ledger.d.ts
+interface Caps {
+  perHour: number;
+  perDay: number;
+}
+interface CapStatus {
+  hour: number;
+  day: number;
+  /** When the next slot frees up, if a cap is reached. */
+  resetAt?: string;
+}
+declare class SendLedger {
+  #private;
+  readonly directory: string;
+  constructor(stateDir: string, now?: () => Date);
+  /** Counts sends (including in-flight reservations) in the last hour and day. */
+  status(inboxId: string, caps: Caps): Promise<CapStatus>;
+  /** Reserves a slot or refuses with APPROVAL_REQUIRED and the time the cap resets. Atomic across processes. */
+  reserve(inboxId: string, approvalId: string, caps: Caps): Promise<CapStatus>;
+  /** Releases a reservation whose send did not happen. */
+  release(inboxId: string, approvalId: string): Promise<void>;
 }
-/**
- * What a record's `inboxId` names. `owner` — a mailbox or account that existed when it was made (every send and
- * download, and a change to one). `prospective` — a change that creates its owner, which has no id yet. `global` — a
- * change to no owner at all, stored with `inboxId: ''`.
- */
-type OwnerScope = "owner" | "prospective" | "global";
 //#endregion
-//#region src/approval-io.d.ts
+//#region src/plans.d.ts
 /**
- * The file operations approval maintenance and the unsent report are made of (design 2026-10-05 §D9), one method
- * each, so that a test can count every one of them — every directory read, metadata stat, record open, lock try,
- * renewal, ownership check and unlink — and none is hidden behind a helper. The store passes the real ones unless it
- * was opened with others.
- *
- * Only these two passes go through it: every other read and write of the store is as it was.
+ * Bulk mailbox changes (more than 20 messages, anything driven by a query, and every trash) are two-step: a dry run
+ * returns a plan token bound to the exact set of ids and the exact change; executing requires that token, once, within
+ * ten minutes. The ids are resolved at dry-run time, so a query cannot silently grow between preview and execution.
  */
-interface ApprovalIo {
-  /** One enumeration of a directory: its entries' names. */
-  readdir(directory: string): Promise<string[]>;
-  /** One metadata stat: the modification time, in milliseconds. */
-  stat(path: string): Promise<{
-    readonly mtimeMs: number;
-  }>;
-  /** One open of a file's content, as text. */
-  readText(path: string): Promise<string>;
-  /** Replaces a file atomically — a temporary file, flushed, renamed — and, when `durable`, syncs its directory too. */
-  writeAtomic(path: string, text: string, options?: {
-    durable?: boolean;
-  }): Promise<void>;
-  /** One unlink of an approval artifact: a record or its claim marker. A missing one rejects with `ENOENT`. */
-  unlink(path: string): Promise<void>;
-  /** The lock files' own operations (`tryFileLock`). */
-  readonly lock: LockIo;
-}
-/** A version-1 record, as 0.13.0 wrote it: a send has no `kind`, and one `digest` stands for the content. */
-interface LegacyApprovalRecord {
-  approvalId: string;
-  /** Absent on a send. */
-  kind?: ApprovalKind | undefined;
-  digestVersion: 1;
+interface PlanRecord {
+  token: string;
   inboxId: string;
-  inboxSub?: string | undefined;
-  draftId: string;
-  draftMessageId: string;
-  digest: string;
-  approvedDigest?: string | undefined;
-  approvedVia?: ApprovalChannel | undefined;
-  policy: SendPolicy;
-  requiredPolicy: SendPolicy;
-  riskFlags: string[];
-  expect: Expectation;
-  challengeHash?: string | undefined;
-  challengeAttempts: number;
-  state: ApprovalState;
+  operation: string;
+  /** Digest of the operation parameters (labels added/removed, archive, trash…). */
+  paramsDigest: string;
+  /** Digest of the sorted id list. */
+  idsDigest: string;
+  count: number;
   createdAt: string;
   expiresAt: string;
-  updatedAt: string;
-  sentMessageId?: string | undefined;
-  reason?: string | undefined;
-  change?: ChangeBinding | undefined;
-  download?: DownloadBinding | undefined;
 }
-/**
- * A version-1 record as every surface shows it: `{ approvalId, kind, state, legacy: true, createdAt, expiresAt }` and
- * the summary a version-2 record shows — its owner, what it was for, and which channel made it when that can be told.
- * Never claimable, and never given a version-2 timestamp it does not hold.
- */
-interface LegacyView {
-  readonly approvalId: string;
-  readonly kind: ApprovalKind;
-  /** Derived as 0.13.0 derived it (`deriveLegacyV1State`). */
-  readonly state: ApprovalState;
-  readonly legacy: true;
-  readonly createdAt: string;
-  readonly expiresAt: string;
-  /** The stored owner, trusted as stored: a version-1 record has no binding to check it against. */
-  readonly inboxId: string;
-  readonly ownerScope: "owner" | "global";
+declare class PlanStore {
+  #private;
+  readonly directory: string;
+  constructor(stateDir: string, now?: () => Date);
+  create(input: {
+    inboxId: string;
+    operation: string;
+    params: unknown;
+    ids: readonly string[];
+  }): Promise<PlanRecord>;
   /**
-   * The channel that made it, when only one could have: an `ibx_` owner is a Gmail mailbox, an `acc_` owner the
-   * stored platform of an account that still exists. Null when nothing says — it then takes part in no channel's
-   * grouping and gets only generic wording.
+   * Consumes a plan exactly once. It must be for the same inbox, operation, parameters and ids; the file is deleted
+   * inside the lock, so a second consume fails.
    */
-  readonly channel: string | null;
-  readonly expect: Expectation;
-  readonly reason?: string | undefined;
-  readonly sentMessageId?: string | undefined;
+  consume(token: string, expected: {
+    inboxId: string;
+    operation: string;
+    params: unknown;
+    ids: readonly string[];
+  }): Promise<PlanRecord>;
 }
 //#endregion
-//#region src/audit.d.ts
+//#region src/secrets.d.ts
 /**
- * Every mailbox write leaves one line here: what was done, to which inbox, with which ids and outcome. Never message
- * bodies, never secrets — recipient *domains* only, so the log can be shared when asking for help.
+ * Where refresh tokens, client secrets and approval keys live. Two backends, chosen per inbox or client and recorded
+ * in config; the choice is never switched at runtime and there is no silent fallback from one to the other.
+ *
+ * - `keychain`: the OS store (macOS Keychain, Windows Credential Manager, Linux Secret Service — pinned, never the
+ *   kernel keyring, which forgets everything on reboot) through the optional `@napi-rs/keyring` package.
+ * - `file`: one owner-only JSON file per secret in an owner-only directory. Chosen explicitly, never by default.
  */
-interface AuditRecord {
-  at: string;
-  /** Immutable inbox id; `alias` is the label at the time. */
-  inboxId: string;
-  alias?: string;
-  operation: string;
-  /** `started` marks the first half of a change recorded before it is made; a later record for the same ids ends it. */
-  outcome: "ok" | "refused" | "failed" | "started";
-  ids?: Record<string, string | string[] | CondensedIds>;
-  recipientDomains?: string[];
+type SecretStoreKind = "keychain" | "file";
+interface SecretStore {
+  readonly kind: SecretStoreKind;
+  get(ref: string): Promise<string | null>;
+  set(ref: string, value: string): Promise<void>;
+  delete(ref: string): Promise<boolean>;
+  /** Forgets any cached value, so the next read goes to the backend (e.g. after another process re-authorised). */
+  invalidate(ref: string): void;
   /**
-   * Full canonical recipient addresses. Only a send writes these: for every other operation the domains are enough,
-   * and storing less is better — but when mail has actually left, "who did it go to" is the first question anyone
-   * asks afterwards, and a domain does not answer it.
+   * Resolves once no earlier call is still occupying the backend. Absent on a store with nothing to wait for.
+   *
+   * For a caller that must not give up on a write: the keychain fails every call fast while a timed-out native call
+   * is still held by an OS dialog, so retrying on a timer spends every attempt against the same stuck call. A
+   * refresh that has already spent Slack's single-use token is that caller — it has one value it cannot get again,
+   * and waiting for the dialog to be answered is the only retry that can succeed.
    */
-  recipients?: string[];
-  approvalId?: string;
-  reason?: string;
-  /** The process that performed the work; daemon work keeps its caller separately in `origin`. */
-  surface?: "cli" | "mcp" | "app" | "daemon";
-  /** The requesting client surface; autonomous work is `daemon`/`daemon`. */
-  origin?: "cli" | "mcp" | "app" | "daemon";
+  settled?(): Promise<void>;
+}
+//#endregion
+//#region src/standing-ledger.d.ts
+/**
+ * The acknowledgement ledger (design 2026-10-19-standing-approvals, S6, S9): one JSONL file per account,
+ * `<state>/standing/<accountId>.jsonl`, shared by every process and locked at `<path>.lock`.
+ *
+ * Every use of a standing approval of the account is a `use` line, written under the lock before its one-shot child
+ * is minted; what became of the act is an `outcome` line after it. The counts — per thread across every standing
+ * approval of the account, per hour and per day of each one — are read from the `use` lines alone, so nothing an
+ * outcome says frees one, and nothing ever removes a line. A count is spent when it is written, never refunded.
+ */
+/** One use: which standing approval, which child, which content, where, and what the acknowledged message said. */
+interface AckUse {
+  kind: "use";
+  at: string;
+  standingId: string;
+  childId: string;
+  act: StandingAct;
+  contentDigest: string;
+  channel: string;
+  ts: string;
+  /** The thread the message is in — its parent's `ts` — or the message's own `ts` outside one. */
+  thread: string;
+  /** Who wrote the acknowledged message, by their Slack id: what `perSender` counts by, across the account. */
+  sender: string;
+  /** SHA-256 of the acknowledged message's text at the act, so an edit since shows. */
+  targetDigest: string;
+  edited: boolean;
+}
+/** What became of one use's act. It records; it frees nothing. */
+interface AckOutcome {
+  kind: "outcome";
+  at: string;
   /**
-   * The policy that decided how this was approved. Written by change approvals, where it is the whole question
-   * afterwards: a loosening a person typed a code for and one an agent claimed after a yes in chat look the same in
-   * the configuration, and only this line tells them apart.
+   * When the act itself started, after the pause between the decision and the act (S9, the lead's call after review):
+   * a use's own `at` is when it was decided.
    */
-  policy?: SendPolicy;
+  actAt?: string;
+  childId: string;
+  outcome: "sent" | "failed" | "unknown";
+  link?: string;
+  notice: string;
+}
+declare class AckLedger {
+  #private;
+  readonly directory: string;
+  constructor(stateDir: string, now?: () => Date);
+  /** The clock this ledger was opened with: what a use is timed by, and its counts' windows measured from. */
+  now(): Date;
+  /** Where an account's ledger is kept: `<state>/standing/<accountId>.jsonl`, for a person told to move it aside. */
+  pathOf(accountId: string): string;
+  /**
+   * Every account's ledger on this machine that holds a line this release cannot read, with the number of each such
+   * line, for the doctor (design 2026-10-19-standing-approvals, the lead's call after review): while one does, no
+   * standing approval of that account can be used — what it counts cannot be known — and nothing else says so. Reads
+   * without the lock: a look, and every line it reads was written whole.
+   */
+  unreadable(): Promise<{
+    accountId: string;
+    path: string;
+    lines: number[];
+  }[]>;
   /**
-   * What daily retention deleted (`operation: 'approval.retained'`, design 2026-10-05 §D9): the approval's kind, its
-   * final state, when it finished and any provider id — never its content or a recipient. Appended durably before the
-   * record is unlinked, so the audit log keeps the terminal history the approval directory no longer does.
+   * Runs `fn` under the account's ledger lock, with every entry as it reads there and `append`, which writes a `use`
+   * line under the lock already held. `fn` must never take this lock again.
+   *
+   * A line this release cannot read refuses the whole call, BAD_DATA, before `fn` runs: a count read without it could
+   * be lower than the truth, and a count is never guessed downwards.
    */
-  retained?: RetainedApproval;
+  withLock<T>(accountId: string, fn: (entries: (AckUse | AckOutcome)[], append: (entry: AckUse) => Promise<void>) => Promise<T>): Promise<T>;
+  /** Records what became of a use's act, taking the lock itself. It never frees a count. */
+  recordOutcome(accountId: string, entry: AckOutcome): Promise<void>;
+  /** Every entry this release can read, oldest first, for a report: a line it cannot read is left out of it. */
+  entries(accountId: string): Promise<(AckUse | AckOutcome)[]>;
 }
-/** Large id lists are condensed so every audit line stays small enough to be appended atomically. */
-interface CondensedIds {
-  count: number;
-  sha256: string;
-  first: string[];
+//#endregion
+//#region src/state.d.ts
+/**
+ * Per-inbox runtime facts that any process may update (last successful refresh, last use, health). Kept out of
+ * config.json so a running server never rewrites user intent — a stale in-memory copy of config written back by a
+ * server could otherwise silently undo a policy the user just tightened.
+ */
+interface InboxRuntimeState {
+  lastRefreshOkAt?: string | undefined;
+  lastUsedAt?: string | undefined;
+  /** Set to `undefined` to clear it: the merged value is dropped when the file is written. */
+  lastError?: {
+    code: string;
+    message: string;
+    at: string;
+  } | undefined;
+  grantedScopes?: string[] | undefined;
+  refreshTokenExpiresAt?: string | undefined;
 }
-declare class AuditLog {
+declare class InboxStateStore {
   #private;
   readonly directory: string;
-  constructor(stateDir: string, now?: () => Date);
-  append(record: Omit<AuditRecord, "at"> & {
-    at?: string;
-  }, options?: {
-    durable?: boolean;
-  }): Promise<AuditRecord>;
-  /** The most recent records, newest last, optionally filtered by inbox and a lower time bound. */
-  tail(options?: {
-    limit?: number;
-    inbox?: string;
-    since?: string;
-  }): Promise<AuditRecord[]>;
+  constructor(stateDir: string);
+  get(inboxId: string): Promise<InboxRuntimeState>;
+  /** Merges `patch` into the stored state under a per-inbox lock. */
+  update(inboxId: string, patch: Partial<InboxRuntimeState>): Promise<InboxRuntimeState>;
+}
+/**
+ * A platform identifier that is not an email address: a Slack user or conversation id.
+ *
+ * It carries its scope because, unlike an address, it is not globally unique — `U024BE7LH` names a different person
+ * in every workspace that happens to mint that id. The address store is deliberately cross-inbox, on the reasoning
+ * that a message read in one mailbox can ask for a send from another; that reasoning does not transfer here, and a
+ * store that matched ids across workspaces would flag an unrelated person every time two workspaces collided.
+ *
+ * The id, never the display name. `@sam` is set by the account that bears it and can be changed to `@finance-bot`
+ * between the message being read and the send being checked; the id cannot.
+ */
+interface TaintHandle {
+  /** `slack`. Lower-cased on the way in. */
+  platform: string;
+  /** The workspace or team the id belongs to — a Slack team id. */
+  scope: string;
+  /** `U024BE7LH`, `C0123`, `D0456`. Passed in the platform's own canonical form; core does not know its shape. */
+  id: string;
+}
+type TaintSource = "header" | "body";
+/** Why the content reached this process. This is separate from `TaintSource`, which remains the cap priority. */
+type TaintOrigin = "read" | "event";
+interface TaintObservation {
+  address: string;
+  source: TaintSource;
+  /** Old readers did not record this, so an omitted origin remains an ordinary read. */
+  origin?: TaintOrigin | undefined;
+  inboxId: string;
+  messageId?: string | undefined;
 }
-/** The step of a batch that failed. */
-type MaintenanceStep = "lock" | "state" | "enumerate" | "stat" | "read" | "write" | "append" | "claim-unlink" | "record-unlink" | "lock-lost" | "cursor";
-/** A failure a batch met: which step, for which record, and the error's code — never anything a record holds. */
-interface MaintenanceError {
-  readonly step: MaintenanceStep;
-  readonly approvalId?: string | undefined;
-  readonly code: string;
+/** The same observation for a handle. `inboxId` is the account that did the reading, as it is for an address. */
+interface TaintHandleObservation {
+  handle: TaintHandle;
+  source: TaintSource;
+  /** Old readers did not record this, so an omitted origin remains an ordinary read. */
+  origin?: TaintOrigin | undefined;
+  inboxId: string;
+  messageId?: string | undefined;
+}
+/** What is never recorded: the user's own addresses and the domains they call internal. */
+interface TaintExclusions {
+  ownAddresses: readonly string[];
+  internalDomains: readonly string[];
+  /**
+   * Handles that are never recorded: the account's own user id, and whoever the caller treats as internal — the
+   * counterpart of `internalDomains`, decided per platform because "internal" means a domain for mail and
+   * workspace membership for Slack, and core should not be the thing that knows the difference.
+   */
+  ownHandles?: readonly TaintHandle[] | undefined;
 }
 /**
- * What one call of `ensurePruned` did. `attempted` — it ran a batch; when it did not, `skipped` says why: not due
- * (a batch ran less than a day ago), busy (another process holds the maintenance lock), or no records (there is no
- * approvals directory at all). `processed` counts the slots whose record work ran to its end, `pruned` the records
- * deleted, `skippedBusy` the records whose lock was held elsewhere and were left. `complete` — the batch reached the end
- * of the directory inside both bounds; hitting 200 slots or the deadline, or losing the lock, leaves it false.
+ * One stored aggregate, exactly as the store holds it (design 2026-10-05 §D4): the newest time anything matched it, the
+ * strongest source ever seen — `header` is kept once seen — and every mailbox that recorded it. Three separate facts,
+ * never one sighting: `touch` replaces the time, keeps a header and unions the mailboxes independently.
  */
-interface MaintenanceStatus {
-  readonly attempted: boolean;
-  readonly processed: number;
-  readonly pruned: number;
-  readonly skippedBusy: number;
-  readonly complete: boolean;
-  readonly errors: readonly MaintenanceError[];
-  readonly skipped?: "not-due" | "busy" | "no-records" | undefined;
+interface TaintAggregate {
+  readonly at: string;
+  readonly source: TaintSource;
+  readonly inboxIds: readonly string[];
+  /** Sorted, duplicate-free provenance. A base entry with no sidecar record is a legacy read. */
+  readonly origins: readonly TaintOrigin[];
 }
-/** What a batch reports of a record it is about to delete: never a body, an address, or anything a sender wrote. */
-interface RetainedApproval {
-  readonly kind: ApprovalKind;
-  readonly state: ApprovalState;
-  /** When it finished: its validated terminal time, or a legacy used record's safe `updatedAt`. */
-  readonly finishedAt: string;
-  /** A used send's provider id, when it has a non-empty one. */
-  readonly providerId?: string | undefined;
-  /** A record an earlier release wrote. */
-  readonly legacy?: true | undefined;
+interface TaintCheck {
+  address: boolean;
+  domain: boolean;
+  /** The exact address's aggregate, when it is in the window. */
+  addressSeen?: TaintAggregate | undefined;
+  /** Its domain's, when that counts — not a public mailbox provider — and is in the window. */
+  domainSeen?: TaintAggregate | undefined;
 }
-interface MaintenanceOptions {
+/** Testable interruption point for the crash-safe, two-lock sidecar protocol. */
+interface TaintStoreHooks {
+  afterOriginsCommit?: (() => Promise<void>) | undefined;
+  onLockAcquired?: ((lock: "origins" | "taint" | "handles") => void) | undefined;
+}
+declare class TaintStore {
+  #private;
+  readonly directory: string;
+  constructor(stateDir: string, now?: () => Date, hooks?: TaintStoreHooks);
   /**
-   * When no further step may start, on the store's clock, in milliseconds: five seconds from the call when left out.
-   * A report passes the one deadline it shares with its own reads.
+   * Records observations. Throws if it cannot — callers must fail the read rather than return content whose taint
+   * was not recorded.
    */
-  readonly deadline?: number | undefined;
+  record(observations: readonly TaintObservation[], exclusions: TaintExclusions, handleObservations?: readonly TaintHandleObservation[]): Promise<void>;
+  /**
+   * Whether an address, or its (non-public) domain, was seen in email content in the window — from any inbox — and the
+   * aggregate each match is made of, for a caller to explain it. Nothing is written.
+   */
+  check(address: string): Promise<TaintCheck>;
+  /**
+   * Whether a handle was seen in message content in the window.
+   *
+   * Only within its own workspace — see `TaintHandle`. There is no second answer to give, the way an address also
+   * carries a domain: two ids sharing a workspace says nothing about either of them.
+   */
+  checkHandle(handle: TaintHandle): Promise<boolean>;
+  /** The merged provenance of a retained handle, or no origins when it is not in the taint window. */
+  checkHandleOrigins(handle: TaintHandle): Promise<readonly TaintOrigin[]>;
 }
 //#endregion
-//#region src/approval-validate.d.ts
-/**
- * The integrity check of a version-2 approval record (design 2026-10-05 §D1, "Digest integrity" and "Version-2
- * timestamps fail closed"). Pure: it reads the record and the id its file is named by, and decides.
- *
- * A record either passes, or is `corrupt` for one fixed reason — never a sentence built from the record, so nothing a
- * file holds is ever echoed — and of one of two attribution classes. `verified`: its `bindingDigest` recomputes, so its
- * owner and identity can be trusted and it is corrupt for another reason (a state, a timestamp, its evidence).
- * `unverifiable`: its binding is missing, malformed or does not match, or it sits in another record's file, so nothing
- * it says about whom it belongs to can be trusted.
- *
- * Nothing here is wired into a read yet; the store's decoder does that.
- */
-/** Why a version-2 record is corrupt: a fixed category, never the record's own words. */
-type IntegrityReason = "file-name-mismatch" | "binding-missing" | "binding-malformed" | "binding-mismatch" | "wrong-shape" | "digest-version" | "content-digest-malformed" | "content-digest-mismatch" | "identity-contradiction" | "listing-mismatch" | "state-impossible" | "lifetime-mismatch" | "timestamp-invalid" | "timestamp-missing" | "timestamp-misplaced" | "timestamp-misordered" | "sent-id-missing" | "evidence-missing" | "evidence-invalid" | "evidence-contradictory";
-type Attribution = "verified" | "unverifiable";
-//#endregion
-//#region src/approval-stored.d.ts
-/**
- * Every approval file, read one way (design 2026-10-05 §D2, "Legacy version-1 records, one decoder everywhere" and
- * "Two classes of parseable corrupt record").
- *
- * A file is one of four things, and every read says which:
- *
- * - `v2` — a version-2 record that passed `validateV2`: the only form anything may act on;
- * - `legacy` — a structurally valid version-1 record, read by its own release's rules: reported, never claimed;
- * - `corrupt` — a parseable version-2 record that failed its integrity check, attributable to its owner or not;
- * - `unreadable` — a file that cannot safely be read at all: shown only as a stub naming its id (from the file name)
- *   and a fixed reason, never anything the file holds.
- *
- * Nothing is silently omitted, and the decoder writes nothing.
- */
-/** Why a file cannot safely be read: a fixed category, never the file's own bytes. */
-type UnreadableReason = "invalid-json" | "truncated" | "missing-ownership" | "missing-kind" | "wrong-shape" | "file-name-mismatch";
-/** What may be said of a record that cannot be trusted: its id, that it is corrupt, and why — nothing else. */
-interface CorruptStub {
-  readonly approvalId: string;
-  readonly state: "corrupt";
-  readonly reason: UnreadableReason | IntegrityReason;
-}
-/** What an attribution-verified corrupt record may still show its owner: the fields its binding was made over. */
-interface OrdinarySafeFields {
-  readonly kind: ApprovalKind;
-  readonly channel: string;
-  readonly ownerScope: OwnerScope;
-  readonly inboxId: string;
-  readonly inboxSub?: string | undefined;
-  readonly draftId: string;
-  readonly draftMessageId: string;
-  readonly expect: Expectation;
-}
-/** A disclosure record has no channel owner or sender-controlled operational fields to expose. */
-interface DisclosureSafeFields {
-  readonly kind: "disclosure";
+//#region src/core.d.ts
+/** Everything a provider package needs from the core, wired to one config directory. */
+interface Core {
+  paths: ResolvedPaths;
+  /** The subset of `paths` explicitly pinned by global CLI options. */
+  pathOverrides: Readonly<PathOverrides>;
+  config: ConfigStore;
+  states: InboxStateStore;
+  approvals: ApprovalStore;
+  ledger: SendLedger;
+  /**
+   * The acknowledgement ledger (design 2026-10-19-standing-approvals, S6, S9): every use of a standing approval,
+   * counted per account, under its own lock, before the use's child is minted — and never refunded.
+   */
+  acks: AckLedger;
+  plans: PlanStore;
+  taint: TaintStore;
+  audit: AuditLog;
+  /** Opens the config directory's one secret backend (as recorded in config, or `kind` before the first write). */
+  secrets(kind?: SecretStoreKind): Promise<SecretStore>;
+  /**
+   * The commands this process tells a person to run — its own CLI's, core's, another product's — located from the
+   * caller it was opened with (`OpenCoreOptions.caller`), for these folders. Undefined when none was given: then there
+   * is no command to print at all, and anything that asks for one meets the programming error `requireHandoffs` throws —
+   * never a bare name. Every package opens core with its caller.
+   */
+  handoffs?: CliHandoffs | undefined;
 }
-type SafeFields = OrdinarySafeFields | DisclosureSafeFields;
-type StoredApproval = {
-  readonly form: "v2";
-  readonly record: ApprovalRecord;
-} | {
-  readonly form: "legacy";
-  readonly view: LegacyView;
-  readonly record: LegacyApprovalRecord;
-} | {
-  readonly form: "corrupt";
-  readonly approvalId: string;
-  readonly reason: IntegrityReason;
-  readonly attribution: Attribution;
-  /** Only when attribution is verified. */
-  readonly safe: SafeFields | null;
-} | {
-  readonly form: "unreadable";
-  readonly stub: CorruptStub;
-};
 //#endregion
-//#region src/approval-outcome.d.ts
+//#region src/standing.d.ts
 /**
- * One locked classification of every record into an outcome (design 2026-10-05 §D2).
+ * Standing approvals (design 2026-10-19-standing-approvals): the person's yes given in advance, for acknowledging — an
+ * exact set of contents they wrote, a bounded set of places, a bounded number of uses, and a time limit. The agent
+ * decides whether to acknowledge a message that has just arrived, and with which of the contents; it never writes the
+ * words, and it cannot pick an old message or a new place.
  *
- * `approvalOutcome` says what a record is now — its state, whether it can be claimed, and what an action on it would be
- * told — from the record as it was read under its own lock and the configuration read in that same lock (`LiveGate`).
- * Nothing here reads a file or a clock of its own, and nothing here writes: the store persists what the outcome
- * derives, and only from inside the lock it was classified under.
- */
-/** What is being done with the record: an approval, a claim, a wait, a revoke, or a look. */
-type OutcomeAction = "approve" | "claim" | "wait" | "revoke" | "inspect";
-/** A record's state as anyone may be told it: a download's answered question says `answered`. */
-type PublicApprovalState = ApprovalState | "corrupt" | "answered";
-/**
- * Where an approval stands, as every surface may show it (design 2026-10-05 §D8): its id, kind, channel, state and
- * whether it can be claimed, with the timestamps its state carries. Never a challenge hash, and nothing a sender wrote.
- */
-interface ApprovalObject {
-  readonly id: string;
-  readonly kind: ApprovalKind | null;
-  readonly channel: string | null;
-  readonly state: PublicApprovalState;
-  readonly claimable: boolean;
-  readonly route?: ApprovalRoute | undefined;
-  readonly ownerRemoved?: true | undefined;
-  /** A record from an earlier release, read by its own rules: shown, never claimed. */
-  readonly legacy?: true | undefined;
-  readonly reason?: string | undefined;
-  readonly createdAt?: string | undefined;
-  readonly expiresAt?: string | undefined;
-  readonly approvedAt?: string | undefined;
-  readonly usableUntil?: string | undefined;
-  readonly sendingAt?: string | undefined;
-  readonly sendingHeartbeatAt?: string | undefined;
-  /** When a `sending` record reads `unknown` (`unknownAtOf`): derived, never stored. Also on an `unknown` one. */
-  readonly unknownAt?: string | undefined;
-  readonly usedAt?: string | undefined;
-  readonly sentAt?: string | undefined;
-  readonly sentMessageId?: string | undefined;
-  readonly failedAt?: string | undefined;
-  readonly revokedAt?: string | undefined;
-  readonly expiredAt?: string | undefined;
-}
-/** What an action on a record is, now. */
-interface ApprovalOutcome {
-  readonly state: PublicApprovalState;
-  readonly claimable: boolean;
-  readonly ownerRemoved?: true | undefined;
-  readonly reason?: string | undefined;
-  /**
-   * A version-2 record as this classification reads it: with a revocation it derived applied (an owner removed, a
-   * stale send epoch, or — for a claim or an approval — a live `never`). Null for every other form.
-   */
-  readonly record: ApprovalRecord | null;
-  /** Whether `record` carries a revocation the classification derived, for a locked action to persist. */
-  readonly revokes: boolean;
-  /** Where it stands, as D8 shows it (`publicApproval`). */
-  readonly approval: ApprovalObject;
-  /** What the action is refused with, when it is refused by the record's state alone. */
-  readonly error?: CommsError | undefined;
+ * This module is the model: the contents, each named by its digest and never by its position (S3); the places (S5);
+ * the limits (S6); the digest a standing record is bound to; and what widens one, which only a person may approve at a
+ * terminal (S8). Pure, but for `raiseStandingEpoch`: nothing else here reads a file or a clock.
+ */
+/** S1: the acts a standing approval may cover. A reaction is only ever added, never removed. */
+declare const STANDING_ACTS: readonly ["reaction", "reply"];
+type StandingAct = (typeof STANDING_ACTS)[number];
+/** One content the person wrote: a standard emoji's name, or a fixed reply. Named by `digest`, never by position. */
+interface StandingContent {
+  kind: StandingAct;
+  text: string;
+  /** `sha256Hex(canonicalJson({ kind, text }))`: the kind and the exact text, and nothing else. */
+  digest: string;
 }
 /**
- * What became of a used send, in the words of the surface that says it, from the time the provider accepted it (D2's
- * used-send row): Gmail and Slack, where acceptance is sending, say it was "sent at …"; Resend's own surfaces that it
- * was "accepted by Resend at …"; core's generic surfaces "accepted by <provider> at …".
+ * Who shares a place, as recorded when it was named (S5). `externalMembers` is null when the place has 50 or more
+ * members, which are not read one by one.
  */
-type UsedSaid = (usedAt: string) => string;
+interface SharedState {
+  extShared: boolean;
+  pendingExtShared: boolean;
+  externalMembers: boolean | null;
+}
+/** A channel or DM named exactly, with what the person was shown of it: its name, its member count and its sharing. */
+interface ExactPlace {
+  id: string;
+  name: string | null;
+  members: number;
+  shared: SharedState;
+}
+/** S5: exact channels or DMs, or the threads in one workspace where the person posted themselves. */
+type StandingPlaces = {
+  kind: "exact";
+  places: ExactPlace[];
+} | {
+  kind: "threads-i-am-in";
+};
 /**
- * Why a saved name has {@link DOWNLOAD_SUFFIX} after it: a name tools read or run on their own (`auto-read`), an
- * extension that is not one of the inert ones (`type`), or no extension at all (`no-extension`).
+ * S6: the limits. `perThread` and `perSender` count across every standing approval of the account: `perSender` is how
+ * many acts a day may answer messages from any one person (the lead's call, after review), the cap on what an injected
+ * agent can say to one recipient by choosing which of their messages to acknowledge.
  */
-type RenameReason = "auto-read" | "type" | "no-extension";
+interface StandingLimits {
+  perThread: number;
+  perHour: number;
+  perDay: number;
+  perSender: number;
+  expiresDays: number;
+}
+/** Exactly what a standing record permits, stored on it so a terminal can show it again and prove it is what was made. */
+interface StandingBinding {
+  /** One line about it, for a listing. Shown; not in the digest. */
+  summary: string;
+  target: {
+    kind: "account";
+    name: string;
+    id: string;
+  };
+  /** Reactions first, then replies, as written. */
+  contents: StandingContent[];
+  places: StandingPlaces;
+  limits: StandingLimits;
+  /** Who proposed it: an agent, over MCP or without a person at the terminal, or the person at their terminal. */
+  proposedBy: "agent" | "person";
+  /** The standing id this widens, which approving it ends. */
+  replaces?: string | undefined;
+  /** S3's warnings, as the preview shows them. */
+  warnings: string[];
+}
+/** What a narrowing keeps: content digests, exact place ids, and lower limits. It applies at once. */
+interface StandingNarrowing {
+  keep?: string[];
+  places?: string[];
+  limits?: Partial<StandingLimits>;
+}
 //#endregion
 //#region src/approvals.d.ts
 /**
@@ -5516,7 +5310,7 @@ type ApprovalChannel = "elicitation" | "terminal";
  * and a kind on every record, so that none can be spent as another. Without it, a person who approved a post at a
  * terminal would also have approved whatever change an agent claimed under the same id.
  */
-type ApprovalKind = "send" | "change" | "download" | "disclosure";
+type ApprovalKind = "send" | "change" | "download" | "disclosure" | "standing";
 /** The inbox or account a change is about. `id` is absent when the change connects it, and it does not exist yet. */
 interface ChangeTarget {
   kind: "inbox" | "account";
@@ -5656,8 +5450,11 @@ interface ApprovalRecord {
    * terminal or in a trusted form. Never on a send or a change, which carry `approvedBindingDigest` instead.
    */
   approvedDigest?: string | undefined;
-  /** Where a person approved, or answered: the terminal, or a trusted client's form. Absent on a chat-route claim. */
-  approvedVia?: ApprovalChannel | undefined;
+  /**
+   * Where a person approved, or answered: the terminal, or a trusted client's form. Absent on a chat-route claim.
+   * `standing` on a standing approval's child, and on nothing else: the person approved it in advance, at a terminal.
+   */
+  approvedVia?: ApprovalChannel | "standing" | undefined;
   /** A send's or a change's approval: when, and the binding the person approved, which must still be the record's. */
   approvedAt?: string | undefined;
   /** `approvedAt + approvedMs`: until when an approved send or change may be claimed. */
@@ -5695,6 +5492,29 @@ interface ApprovalRecord {
   download?: DownloadBinding | undefined;
   /** For a standing disclosure: the canonical, content-free event activation authority. */
   disclosure?: DisclosureBinding | undefined;
+  /**
+   * For a standing approval (`kind: 'standing'`, design 2026-10-19-standing-approvals): exactly what it permits.
+   * `contentDigest` is `standingDigest` of this.
+   */
+  standing?: StandingBinding | undefined;
+  /** For a standing approval: what has been narrowed since, at once. Not bound: it can only take away (S8). */
+  narrowed?: StandingNarrowing | undefined;
+  /** On a standing approval and its children: the standing epoch as read when it was made. Bound. */
+  standingEpoch?: number | undefined;
+  /** On a standing approval's child: the standing approval it is one use of. Bound. */
+  standingId?: string | undefined;
+  /**
+   * On a standing approval's child: where its act goes and which of its standing approval's contents it sends, by
+   * digest — what its claim checks the standing approval still covers. Bound.
+   */
+  standingUse?: StandingUseBinding | undefined;
+  /**
+   * On an approved standing approval: the change policy that governed its account when the person approved it — its
+   * own, else the default. Written with the approval, beside `approvedAt`. A live change policy stricter than this has
+   * ended it (`changePolicy-tightened`), whatever the standing epoch says: a release that knows no standing epoch can
+   * still tighten the policy (design 2026-10-19-standing-approvals, S8, the lead's call after review).
+   */
+  approvedChangePolicy?: ChangePolicy | undefined;
 }
 /**
  * The stored branch for standing disclosure. Its runtime decoder refuses every field belonging to send, change or
@@ -5834,511 +5654,976 @@ interface ApprovalStoreOptions {
    * The file operations daily maintenance and the unsent report go through — the real ones when left out; a test's to
    * count and interrupt every step. Every other read and write of the store is unaffected.
    */
-  io?: ApprovalIo | undefined;
+  io?: ApprovalIo | undefined;
+  /**
+   * Told when a person has answered a send or post: approved at a terminal, or claimed to be sent — the person's yes
+   * under the chat policy (design 2026-10-16, U7: the security line a preview carried counts as asked once its approval
+   * is answered). Never when it is only prepared, refused or revoked. Awaited, and whatever it throws is ignored:
+   * nothing it does may stop a send. `openCore` passes `securityAnswered`.
+   */
+  answered?: ((approvalId: string) => Promise<void>) | undefined;
+}
+declare class ApprovalStore {
+  #private;
+  readonly directory: string;
+  /** `ApprovalStoreOptions.answered`, never throwing. */
+  readonly answered: ((approvalId: string) => Promise<void>) | undefined;
+  constructor(stateDir: string, options?: ApprovalStoreOptions);
+  /**
+   * Daily retention (design 2026-10-05 §D9): once a day per state directory, a bounded batch deletes valid finished
+   * records ninety days past their finish. Awaited before every creation, list, status and wait — with its own
+   * five-second budget — and before a report, on the report's shared deadline. Never a gate: whatever it finds, it
+   * returns its status and the caller goes on.
+   */
+  ensurePruned(options?: MaintenanceOptions): Promise<MaintenanceStatus>;
+  create(input: CreateApprovalInput): Promise<ApprovalRecord>;
+  /** Creates only a pending standing disclosure approval from a daemon-derived canonical binding. */
+  createDisclosure(binding: DisclosureBinding): Promise<DisclosureApprovalRecord>;
+  /**
+   * One approval, in whichever of its four forms it is (`StoredApproval`), read against one configuration snapshot —
+   * or null when there is none. Nothing is written.
+   */
+  get(approvalId: string): Promise<StoredApproval | null>;
+  /**
+   * A look at one approval, under its lock: the record as it stands and its classification for `expect` — the same
+   * `NOT_FOUND` as every action for an id that is not what the caller expects, before anything of the record is
+   * classified. It writes only what reading derives (an expiry, a dead send's `unknown`), never a revocation: an owner
+   * removed or a stale epoch is shown as revoked here, and written by the next action.
+   *
+   * `action` is for a surface about to act on what it reads — a terminal about to show a preview, an execute about to
+   * read its draft — classified for that action (`approve`, `claim`, `revoke`), so the refusal is the one the action
+   * would get. A revocation the classification derives for it is written then, as the action itself would write it:
+   * the first locked action persists it, and this is that action's first step (design 2026-10-05 §D2).
+   */
+  inspect(approvalId: string, expect?: ApprovalExpectation, options?: {
+    action?: OutcomeAction | undefined;
+    usedSaid?: UsedSaid | undefined;
+  }): Promise<{
+    stored: StoredApproval;
+    outcome: ApprovalOutcome;
+  }>;
+  /**
+   * D8's object for a record a call has just written, claimed or finished — what its result reports. Classified as a
+   * look at it would be, against a fresh read of the configuration, without the lock and writing nothing: what decided
+   * was the transition that wrote it. A configuration that cannot be read leaves only what the record says (nothing
+   * claimable): a report never fails the call it reports on, least of all one that has already sent.
+   */
+  approvalOf(record: ApprovalRecord): Promise<ApprovalObject>;
+  /**
+   * The classification of a record a call has just written, in any of its forms — a revoke's, a cancel's — for its
+   * result to show through `publicApproval`, as a status, a wait and a list show theirs: what a sender wrote only inside
+   * the untrusted-content envelope (design 2026-10-05 §D8). Classified as a look at it would be, against a fresh read of
+   * the configuration, without the lock and writing nothing, as `approvalOf` is; a configuration that cannot be read
+   * leaves nothing claimable, and never fails the call it reports on.
+   */
+  outcomeOf(stored: StoredApproval): Promise<ApprovalOutcome>;
+  /** Issues a new challenge to show a human; only its hash is kept. */
+  issueChallenge(approvalId: string, kind?: ApprovalKind, _platform?: NodeJS.Platform, options?: {
+    usedSaid?: UsedSaid | undefined;
+  }): Promise<string>;
+  /** Issues the typed challenge that a terminal or the trusted desktop app must answer for disclosure. */
+  issueDisclosureChallenge(approvalId: string): Promise<string>;
+  /**
+   * Approves one exact standing disclosure authority. MCP/chat forms are never an approval channel here: `app` means
+   * the desktop application's trusted typed-challenge bridge, not a client form.
+   */
+  approveDisclosure(approvalId: string, liveBinding: DisclosureBinding, answer: string, via: "terminal" | "app"): Promise<DisclosureApprovalRecord>;
+  /**
+   * Claims an approved disclosure once, persisting the exact `usedAt` that recovery must subsequently reuse.
+   * A specialised caller may impose a shorter deadline; it is evaluated while this record's transition lock is held,
+   * so a check made before waiting on that lock cannot accidentally consume the approval after it has expired.
+   */
+  claimForDisclosure(approvalId: string, liveBinding: DisclosureBinding, options?: {
+    readonly deadlineMs?: number | undefined;
+  }): Promise<DisclosureApprovalRecord>;
+  /**
+   * A human approved through a confirm channel by typing the issued challenge. The draft must still be exactly what the
+   * record was prepared for; otherwise the record is voided, because the human would be approving content the record
+   * does not describe. Three wrong answers void it too.
+   *
+   * A change is approved the same way, with `kind: 'change'` and its digest standing in for the draft (see
+   * `createChange`), so a person's typed code means one thing whichever kind of approval it is typed for.
+   */
+  approve(approvalId: string, via: ApprovalChannel, live: LiveDraft, answer: string, kind?: ApprovalKind, _platform?: NodeJS.Platform, options?: {
+    usedSaid?: UsedSaid | undefined;
+  }): Promise<ApprovalRecord>;
+  /**
+   * Claims the record for sending, once. Non-consuming refusals (not yet approved) leave the record untouched so the
+   * human can still approve it; integrity failures (another account, an edited or changed draft, different recipients
+   * or subject) void it. Success creates the O_EXCL claim marker.
+   *
+   * `live.inboxId` is the owner the caller claims for: a record of another owner is the one `NOT_FOUND`, and left as it
+   * is. The policy is the live gate's, from the configuration read under the record's lock (decision 4): a value the
+   * caller read before the lock is exactly what a `never` change can land between.
+   */
+  claimForSend(approvalId: string, live: LiveDraft & {
+    inboxId: string;
+    inboxSub?: string | undefined;
+    expect: Expectation;
+  }, options?: ClaimOptions): Promise<SendClaim>;
+  /**
+   * Renews the sending lease of a send this call claimed: writes `sendingHeartbeatAt` while the claim still owns a
+   * `sending` record, and nothing otherwise. `renewed` while it is sending; `lost` once it reads `unknown` (or anything
+   * else) — a renewal never moves a record back to `sending`. Refused, writing nothing, without the claim's token.
+   */
+  heartbeat(approvalId: string, claimToken: string): Promise<"renewed" | "lost">;
+  /**
+   * The check before each provider step (design 2026-10-05 §D1): `go`, with the lease renewed, while this claim still
+   * owns a `sending` record; `stop` once it reads `unknown` — another caller has decided its outcome cannot be known,
+   * and no further step may start. Refused, writing nothing, without the claim's token.
+   */
+  fence(approvalId: string, claimToken: string): Promise<"go" | "stop">;
+  /**
+   * A change approval, pending, bound to `changeDigest(input.change)`.
+   *
+   * The digest is computed here, never taken from the caller, so a record cannot claim to be bound to one change while
+   * describing another. It stands in for the draft revision too, as a reaction's does: a change has no draft, and the
+   * same value means the same change.
+   */
+  createChange(input: CreateChangeApprovalInput): Promise<ApprovalRecord>;
+  /**
+   * Claims a change approval, once, for the change the caller is about to write.
+   *
+   * `live.change` is the change as the caller computes it now, and it has to digest to what was prepared: a different
+   * path, a different value, a different account or a different effect voids the approval, because the person agreed
+   * to something else. `live.policy` is the change policy in force now, and the stricter of it and the one at prepare
+   * decides — so tightening the policy after an agent prepared a change takes effect on that change, and loosening it
+   * does not release one prepared under `confirm`.
+   *
+   * Under `chat` a pending approval is claimable: the yes was given in the conversation. Anything stricter needs a
+   * person to have typed the code at a terminal first; until then the refusal leaves the record as it is.
+   */
+  claimForChange(approvalId: string, live: LiveChange, options?: ClaimOptions): Promise<ApprovalRecord>;
+  /**
+   * A standing approval (design 2026-10-19-standing-approvals, S8), pending, bound to `standingDigest` of its binding —
+   * computed here, never taken from the caller — and to the send epoch of its account and the standing epoch, both as
+   * read when it is made.
+   *
+   * Its route is `confirm` and its `requiredPolicy` `confirm` whatever the change policy is, because what it permits
+   * happens with nobody asked: it is approved only with the code typed at a terminal (`approve`, `via: 'terminal'`),
+   * never by a yes in the chat, a client's form, or an answer carried in a call. It lasts its days once approved
+   * (`approvedMs`). Nothing ever claims it: each use mints a child (`createStandingChild`).
+   *
+   * The binding is checked before anything is written (`canonicalStandingBinding`): a custom emoji, a reply with a
+   * link, a limit outside the table or a place that is no Slack id is refused, however the caller assembled it.
+   */
+  createStanding(input: {
+    binding: StandingBinding;
+    inboxSub: string;
+    sendEpoch: number;
+    standingEpoch: number;
+  }): Promise<ApprovalRecord>;
+  /**
+   * Runs `use` under the standing record's own lock, with the record as it reads there and its classification for a
+   * use (`claim`): its expiry, a revocation the configuration derives — its account removed, `never`, a send epoch or
+   * a standing epoch behind the live one — written before `use` runs, and `outcome.error` set for every state that
+   * refuses a use. `owner` is the account the caller acts for: any other's record is the one `NOT_FOUND`.
+   *
+   * What `use` decides is decided while no revocation, narrowing or approval of this record can land. `use` must not
+   * take this record's lock again: it is held.
+   */
+  withStanding<T>(standingId: string, owner: string, use: (record: ApprovalRecord, outcome: ApprovalOutcome) => Promise<T>): Promise<T>;
+  /**
+   * One use of a standing approval (S9): a send record, approved the moment it is made — `route: 'standing'`,
+   * `approvedVia: 'standing'`, `approvedAt` its creation — bound to the standing id, the standing epoch and the send
+   * epoch, and usable once, within `APPROVAL_LIFETIMES.standingChild`. It then takes the one send path every send
+   * takes: `claimForSend`, its O_EXCL marker, the fence and the outcome.
+   *
+   * Minted only by the use (`mintStandingUse`), under the account's acknowledgement ledger lock and then the standing
+   * record's, after every check there. Checked again here, read without that lock — which the caller holds: the
+   * standing record must be this account's, approved at a terminal, under the same epochs and the same account user,
+   * and not ended, or nothing is written. A child never names anything but what its use was checked for.
+   */
+  createStandingChild(input: {
+    /**
+     * The id the child is made under, when its use was counted under it first (`mintStandingUse`): an id this store
+     * would make, and one no record holds. A new one when left out.
+     */
+    approvalId?: string | undefined;
+    standingId: string;
+    standingEpoch: number;
+    inboxId: string;
+    inboxSub: string;
+    draftId: string;
+    draftMessageId: string;
+    contentDigest: string;
+    sendEpoch: number;
+    riskFlags: string[];
+    expect: Expectation;
+    /** Where the act goes, and which of the standing approval's contents it sends: what its claim checks again. */
+    use: StandingUseBinding;
+  }): Promise<ApprovalRecord>;
+  /**
+   * Narrows a standing approval at once (S8): fewer contents or places, a lower limit, an earlier end. Nothing is asked
+   * for, because nothing more is permitted: anything `classifyStandingChange` calls a widening of what is in force is
+   * refused with USAGE, and the record is left as it was. The binding the person approved stays the record's own, and
+   * what is narrowed is kept beside it, where it can only take away.
+   */
+  narrowStanding(standingId: string, owner: string, narrowing: StandingNarrowing): Promise<ApprovalRecord>;
+  /**
+   * A download's question, pending, bound to `downloadDigest(input.download)` — computed here, never taken from the
+   * caller, as a change's digest is. It stands in for the draft revision too.
+   *
+   * `policy` is the change policy of the mailbox or workspace the files come from, as it stands when the question is
+   * asked: where a stranger's files land on this machine is a change to it, and is answered the way that account's
+   * other changes are approved. A claim holds the question to the stricter of this and the policy then.
+   */
+  createDownload(input: {
+    /** The manifest channel the files come from. */
+    channel: string;
+    download: DownloadBinding;
+    policy: ChangePolicy;
+  }): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
+  /**
+   * Records the person's answer to a download's question, given where an agent cannot give it: at their own terminal,
+   * or in a form a trusted client showed them. The question moves to `approved`, carrying the answer, and waits for
+   * the download to claim it — which it may then do under `confirm`, and which saves where this answer says.
+   *
+   * Only a pending question can be answered, and only once: a second answer is refused, not taken over the first.
+   */
+  answerDownload(approvalId: string, via: ApprovalChannel, answer: RecordedSaveAnswer, _platform?: NodeJS.Platform): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
+  /**
+   * Claims a download's question, once, for the download the caller is about to make — and returns it, with the
+   * folders it offered, so that `downloads` and `current` in the answer mean the paths the person read, and with the
+   * answer the person recorded, when they recorded one.
+   *
+   * `live` is the download as the caller computes it now: the same account, the same request, the same files under
+   * the same names — the person answered for those files and no others. Any other is refused, and the question left
+   * open, as it was: a second call that got an argument wrong is the agent's slip, not the person's, and voiding the
+   * question for it would make the person answer again for nothing. It still expires, and is claimed once.
+   *
+   * Whether it can be claimed is the download `claimable` matrix (`downloadClaimable`, design 2026-10-05 §D2), decided
+   * under the question's lock against the live change policy read there — never a policy the caller read before it.
+   * While both the policy the question was asked under and the live one are `chat`, a pending question is claimed
+   * with the answer the caller carries: the person gave it in the conversation, and it is never kept. Otherwise only a
+   * question the person answered at a terminal or in a trusted form can be claimed; a pending one is refused, and left
+   * as it is, so they can still answer it. One used, voided, expired or corrupt is refused for what it is.
+   *
+   * `options.signal` is the download's cancellation, asked under the lock as a send's is (`ClaimOptions.signal`): a
+   * download cancelled while this waited saves nothing and leaves the question open, the answer still unused.
+   */
+  claimForDownload(approvalId: string, live: DownloadRequest, options?: {
+    pendingHint?: string | undefined;
+    signal?: AbortSignal | undefined;
+    platform?: NodeJS.Platform | undefined;
+    handoffs?: CliHandoffs | undefined;
+  }): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
+  /**
+   * Records the outcome of the one send attempt: `used` with the provider's id for it, when the provider accepted it,
+   * or `failed`.
+   *
+   * `used` needs a non-empty id. A provider that accepted a send without one has not given anything to record it by,
+   * so the record is left as it is — `sending`, and then `unknown` — rather than made `used` with an empty id that
+   * every later reader would take for one.
+   *
+   * Only the claimant records it, by its claim token, from `sending` or from `unknown`: a provider's answer that
+   * arrives after the lease ran out is still the truth. A late success clears the stale-lease reason; a late failure
+   * replaces it with its own.
+   */
+  complete(approvalId: string, claimToken: string, outcome: SendOutcome): Promise<ApprovalRecord>;
+  /**
+   * Voids a pending or approved record. Other records are left as they are, and returned as they read.
+   *
+   * `disposition` says whose decision this is, and has no default: every caller chooses (`RevokeDisposition`). A
+   * version-1 record is retired in its own shape when a person or an owner's removal revokes it (`revokeLegacy`), and
+   * refused with the version refusal, nothing written, when this release's integrity check would have voided it. A
+   * corrupt or unreadable record is never revoked or rewritten: it is refused with the integrity refusal, which repeats
+   * only its stub.
+   */
+  revoke(approvalId: string, reason: string, options: {
+    disposition: RevokeDisposition;
+    expect?: ApprovalExpectation | undefined;
+  }): Promise<StoredApproval>;
   /**
-   * Told when a person has answered a send or post: approved at a terminal, or claimed to be sent — the person's yes
-   * under the chat policy (design 2026-10-16, U7: the security line a preview carried counts as asked once its approval
-   * is answered). Never when it is only prepared, refused or revoked. Awaited, and whatever it throws is ignored:
-   * nothing it does may stop a send. `openCore` passes `securityAnswered`.
+   * Retires a record from an earlier release (version 1) in that release's own shape, so a process still running it
+   * can no longer claim the record — and nothing more.
+   *
+   * Under the record's own lock, `<id>.json.lock`, the one 0.13.0's transitions take, so the two serialise. The file
+   * is read again there, decoded, and its state derived by its own release's rules (`deriveLegacyV1State`). Only a
+   * `pending` or `approved` record is rewritten, as itself plus `state: 'revoked'`, the reason and `updatedAt`: its
+   * digest version stays 1, a send stays without a `kind`, and no field of this release's is added — no claim marker
+   * either. Any other derived state is returned as it reads and written nothing: an expired record is never rewritten,
+   * as `revoke` leaves every finished record as it is.
+   *
+   * It reads no configuration and needs no owner, so it works on a record whose account is already gone. Its only
+   * callers are a person's revoke, the removal of the record's owner, and the legacy drain.
    */
-  answered?: ((approvalId: string) => Promise<void>) | undefined;
-}
-declare class ApprovalStore {
-  #private;
-  readonly directory: string;
-  /** `ApprovalStoreOptions.answered`, never throwing. */
-  readonly answered: ((approvalId: string) => Promise<void>) | undefined;
-  constructor(stateDir: string, options?: ApprovalStoreOptions);
+  revokeLegacy(approvalId: string, reason: string): Promise<LegacyApprovalRecord>;
   /**
-   * Daily retention (design 2026-10-05 §D9): once a day per state directory, a bounded batch deletes valid finished
-   * records ninety days past their finish. Awaited before every creation, list, status and wait — with its own
-   * five-second budget — and before a report, on the report's shared deadline. Never a gate: whatever it finds, it
-   * returns its status and the caller goes on.
+   * Every approval file, each looked at under its own lock and classified there, as `inspect` looks at one — against one
+   * configuration snapshot, loaded once before any file is read (design 2026-10-05 §D2, §D8). What a list shows: each
+   * record's form and its outcome, nothing skipped. Like a look, it writes only what reading derives — an expiry at its
+   * boundary, a stale send's `unknown` — never a revocation: an owner removed or a stale epoch is shown as revoked, and
+   * written by the next action.
+   *
+   * `inboxId` keeps the records whose owner is that id (`ownerOf`), so one whose owner cannot be trusted never matches;
+   * `states` keeps those whose classified state is listed — a stored state, `corrupt`, and for a download's answered
+   * question its stored `approved` or `used`.
    */
-  ensurePruned(options?: MaintenanceOptions): Promise<MaintenanceStatus>;
-  create(input: CreateApprovalInput): Promise<ApprovalRecord>;
-  /** Creates only a pending standing disclosure approval from a daemon-derived canonical binding. */
-  createDisclosure(binding: DisclosureBinding): Promise<DisclosureApprovalRecord>;
+  inspectAll(filter?: {
+    inboxId?: string;
+    states?: (ApprovalState | "corrupt")[];
+  }): Promise<Array<{
+    stored: StoredApproval;
+    outcome: ApprovalOutcome;
+  }>>;
   /**
-   * One approval, in whichever of its four forms it is (`StoredApproval`), read against one configuration snapshot —
-   * or null when there is none. Nothing is written.
+   * Every approval file, each in one of its four forms — nothing skipped, nothing omitted — read against one
+   * configuration snapshot, loaded once before any file is read: a loader that fails fails the whole list.
+   *
+   * `inboxId` keeps the records whose owner is that id (`ownerOf`), so a file whose owner cannot be trusted never
+   * matches one; `states` keeps those whose state (`stateOf`, `corrupt` for one that cannot be used) is listed.
    */
-  get(approvalId: string): Promise<StoredApproval | null>;
+  list(filter?: {
+    inboxId?: string;
+    states?: (ApprovalState | "corrupt")[];
+  }): Promise<StoredApproval[]>;
+}
+//#endregion
+//#region src/config-hooks.d.ts
+/**
+ * Test-only pauses inside `ConfigStore.convertToVersion3`, for the tests that prove a write racing the conversion is
+ * neither lost nor let in between its scan and its write.
+ *
+ * Deliberately not exported from the package root, as `enableNamesMigrationForTests` is not (`release-gate.ts`): a
+ * store is given them through its constructor under this symbol, which only a test importing this file by path can
+ * name. No consumer of the package can reach it.
+ */
+declare const CONVERSION_HOOKS: unique symbol;
+interface ConversionHooks {
+  /** After the read before the lock, before the config lock is taken. */
+  beforeLock?: (() => Promise<void> | void) | undefined;
+  /** Under the lock, after the approvals were scanned and before the version-3 write is built. */
+  afterScan?: (() => Promise<void> | void) | undefined;
+  /** Under the lock, immediately before the version-3 write. */
+  beforeWrite?: (() => Promise<void> | void) | undefined;
+}
+type SendPolicy = "chat" | "confirm" | "never";
+/**
+ * How a loosening of the configuration is approved: `chat` — the person says yes in the conversation and the agent
+ * claims the approval — or `confirm` — the person types a code at a terminal, as for a send under `confirm`.
+ *
+ * There is no `never`. A setting the software refused ever to loosen would leave editing the file by hand as the only
+ * way to change it, and that passes no gate at all.
+ */
+type ChangePolicy = "chat" | "confirm";
+/** 0.18's switch for the daily update check: what `defaults.updates` reads from until a level is set. */
+type UpdateCheckSetting = "on" | "off";
+type StoreKind = "keychain" | "file";
+interface ClientConfig {
+  provider: string;
+  clientId: string;
+  projectId?: string | undefined;
+  secretRef: string;
+  addedAt: string;
   /**
-   * A look at one approval, under its lock: the record as it stands and its classification for `expect` — the same
-   * `NOT_FOUND` as every action for an id that is not what the caller expects, before anything of the record is
-   * classified. It writes only what reading derives (an expiry, a dead send's `unknown`), never a revocation: an owner
-   * removed or a stale epoch is shown as revoked here, and written by the next action.
+   * The organisation profile that made this row and owns it (design 2026-10-02 §D4) — absent on a row a person
+   * registered, or one a profile adopted. A row carrying it is the profile's to change: `org update` and `org remove`
+   * change it, and `client add --replace` and `client remove` refuse it while its organisation has a record.
    *
-   * `action` is for a surface about to act on what it reads — a terminal about to show a preview, an execute about to
-   * read its draft — classified for that action (`approve`, `claim`, `revoke`), so the refusal is the one the action
-   * would get. A revocation the classification derives for it is written then, as the action itself would write it:
-   * the first locked action persists it, and this is that action's first step (design 2026-10-05 §D2).
+   * Additive: client rows are loose, so a release that does not know the key keeps it through its writes.
    */
-  inspect(approvalId: string, expect?: ApprovalExpectation, options?: {
-    action?: OutcomeAction | undefined;
-    usedSaid?: UsedSaid | undefined;
-  }): Promise<{
-    stored: StoredApproval;
-    outcome: ApprovalOutcome;
-  }>;
+  organisation?: string | undefined;
+}
+interface InboxConfig {
+  /** Immutable id (`ibx_` + 16 base32 characters). Secrets and all state are keyed by it; the alias is a label. */
+  id: string;
+  provider: string;
+  email: string;
+  /** Stable account id (OIDC `sub`). Absent for inboxes imported from tools that never asked for it. */
+  sub?: string | undefined;
+  identity: "oidc" | "legacy";
+  client: string;
+  tier: string;
+  contacts: boolean;
+  grantedScopes: string[];
+  secretRef: string;
+  sendPolicy?: SendPolicy | undefined;
+  /** Overrides `defaults.changePolicy` for changes to this inbox. */
+  changePolicy?: ChangePolicy | undefined;
+  internalDomains: string[];
+  createdAt: string;
+}
+interface Defaults {
+  sendPolicy: SendPolicy;
   /**
-   * D8's object for a record a call has just written, claimed or finished — what its result reports. Classified as a
-   * look at it would be, against a fresh read of the configuration, without the lock and writing nothing: what decided
-   * was the transition that wrote it. A configuration that cannot be read leaves only what the record says (nothing
-   * claimable): a report never fails the call it reports on, least of all one that has already sent.
+   * How a loosening is approved wherever an inbox or account does not say otherwise. Absent reads as `chat`.
+   *
+   * Absent rather than filled in by the schema, unlike `sendPolicy`. A config written before this setting existed
+   * reads as `chat` from then on, and the release note says so; a default the schema supplied would be written into
+   * the file by the next unrelated change, where it would look like a choice somebody made.
    */
-  approvalOf(record: ApprovalRecord): Promise<ApprovalObject>;
+  changePolicy?: ChangePolicy | undefined;
+  riskEscalation: boolean;
+  sendCaps: {
+    perHour: number;
+    perDay: number;
+  };
+  attachRoots: string[];
+  /** Extra deny entries on top of the built-in list. */
+  attachDeny: string[];
+  downloadsDir?: string | undefined;
+  timezone: string;
+  confirm: {
+    /**
+     * Fail-closed allowlist of MCP `clientInfo.name` values whose form elicitation is trusted to reach a human.
+     * Empty by default; only the CLI adds entries, after a probe.
+     */
+    elicitationClients: string[];
+  };
   /**
-   * The classification of a record a call has just written, in any of its forms — a revoke's, a cancel's — for its
-   * result to show through `publicApproval`, as a status, a wait and a list show theirs: what a sender wrote only inside
-   * the untrusted-content envelope (design 2026-10-05 §D8). Classified as a look at it would be, against a fresh read of
-   * the configuration, without the lock and writing nothing, as `approvalOf` is; a configuration that cannot be read
-   * leaves nothing claimable, and never fails the call it reports on.
+   * The daily update check (design 2026-09-28): once a day this machine asks npm whether a newer release is out, and
+   * every server and command stops until it is updated or put off until tomorrow. Absent reads as `on`.
+   *
+   * Absent rather than filled in, as `changePolicy` is: a default the schema supplied would be written into the file
+   * by the next unrelated change, where it would look like a choice somebody made. Turning it off is a loosening —
+   * it is what keeps a machine from quietly falling behind a release — so it is approved like one; on applies at once.
    */
-  outcomeOf(stored: StoredApproval): Promise<ApprovalOutcome>;
-  /** Issues a new challenge to show a human; only its hash is kept. */
-  issueChallenge(approvalId: string, kind?: ApprovalKind, _platform?: NodeJS.Platform, options?: {
-    usedSaid?: UsedSaid | undefined;
-  }): Promise<string>;
-  /** Issues the typed challenge that a terminal or the trusted desktop app must answer for disclosure. */
-  issueDisclosureChallenge(approvalId: string): Promise<string>;
+  updateCheck?: UpdateCheckSetting | undefined;
   /**
-   * Approves one exact standing disclosure authority. MCP/chat forms are never an approval channel here: `app` means
-   * the desktop application's trusted typed-challenge bridge, not a client form.
+   * How this machine updates (design 2026-10-16, U2): `auto`, `every-14-days` or `never`. Absent reads from
+   * `updateCheck` — `on` as `auto`, `off` as `never` — and both absent as `auto`. A word this release does not know
+   * reads as `auto`, and the file stays readable: a later release may add a level.
+   *
+   * Moving to a level that updates less is a loosening, approved like one; moving back applies at once. Every write of
+   * a level writes `updateCheck` beside it, `off` for `never` and `on` otherwise, so a release before 0.20 sharing the
+   * file checks, or does not, as the person chose.
    */
-  approveDisclosure(approvalId: string, liveBinding: DisclosureBinding, answer: string, via: "terminal" | "app"): Promise<DisclosureApprovalRecord>;
+  updates?: string | undefined;
+}
+/**
+ * A connected account on a platform that is not mail: a Slack workspace, and every channel after it (design
+ * 2026-09-26) — one generic record, whatever the platform.
+ *
+ * `id`, `platform`, `workspace` (the container: a Slack team, a Resend team, a WhatsApp store), `userId` (who it acts
+ * as), `tier`, `mode`, `grantedScopes`, `secretRef`, the two policies and `createdAt` are every channel's. A channel
+ * may keep keys of its own beside them — Slack's `appId`, `redirectPort` — and they are kept through every write. It
+ * may not add a safety setting: only `sendPolicy`, `changePolicy` and `mode` are judged by `classifyChange`, so a key
+ * of a channel's own that loosened something would loosen it unasked.
+ *
+ * `secretRef` stays required, although the 2026-09-26 contract made it optional for a channel with no credential:
+ * every earlier release requires it, and they share this file — an account without one would make the whole
+ * configuration unreadable to a server started last week. Such a channel records a reference that names no secret,
+ * `<platform>:none:<id>`, until a config version can say otherwise.
+ *
+ * It sits beside `inboxes` rather than replacing it. The spec asked for one `accounts` map holding everything, and
+ * that rename is the one change this file cannot take: `version: 1` is additive precisely because an MCP server
+ * started last week and a CLI run today share the file, and a release that moved every mailbox out of `inboxes`
+ * would read, to the older of the two, as a config with no mailboxes in it. What the rename was for — one list of
+ * everything connected, whatever the platform — is a question about the shape of the answer, not the shape of the
+ * file, so `connectedAccounts()` provides it and the file grows one key.
+ */
+interface AccountConfig {
+  id: string;
+  /** `slack`. */
+  platform: string;
+  /** The workspace or team id. Every other id this account sees is only meaningful inside it. */
+  workspace: string;
+  /** "Acme Corp" — shown to people, never matched on: a workspace can be renamed and stays the same workspace. */
+  workspaceName?: string | undefined;
+  /** This account's own user id in that workspace, so its own messages can be told from everyone else's. */
+  userId: string;
+  tier: string;
+  grantedScopes: string[];
+  /** Where its credential is in the secret store, `<platform>:…` — for a channel that stores none, `<platform>:none:<id>`. */
+  secretRef: string;
+  sendPolicy?: SendPolicy | undefined;
+  /** Overrides `defaults.changePolicy` for changes to this account. */
+  changePolicy?: ChangePolicy | undefined;
+  createdAt: string;
   /**
-   * Claims an approved disclosure once, persisting the exact `usedAt` that recovery must subsequently reuse.
-   * A specialised caller may impose a shorter deadline; it is evaluated while this record's transition lock is held,
-   * so a check made before waiting on that lock cannot accidentally consume the approval after it has expired.
+   * The OAuth client this account's token was issued by, and the app it belongs to.
+   *
+   * Recorded because the Gmail release found the opposite: a reauth used the first OAuth client in the config
+   * rather than the inbox's own, and then did not record which one it had used. Slack makes that worse — D8
+   * means **one app per workspace**, so "the first app" is wrong more often than it is right — and a reauth
+   * that silently moves an account onto a different app changes what it can do without saying so.
+   *
+   * Optional because the key is additive: a config written before these existed parses unchanged.
    */
-  claimForDisclosure(approvalId: string, liveBinding: DisclosureBinding, options?: {
-    readonly deadlineMs?: number | undefined;
-  }): Promise<DisclosureApprovalRecord>;
+  oauthClientId?: string | undefined;
+  appId?: string | undefined;
   /**
-   * A human approved through a confirm channel by typing the issued challenge. The draft must still be exactly what the
-   * record was prepared for; otherwise the record is voided, because the human would be approving content the record
-   * does not describe. Three wrong answers void it too.
+   * `read` or `send`, as installed.
    *
-   * A change is approved the same way, with `kind: 'change'` and its digest standing in for the draft (see
-   * `createChange`), so a person's typed code means one thing whichever kind of approval it is typed for.
+   * Kept beside `grantedScopes` rather than derived from them, because the two answer different questions: the
+   * scopes are what Slack granted, and this is what the person asked for. A disagreement between them is drift
+   * worth reporting, and a value derived from the scopes could never disagree.
    */
-  approve(approvalId: string, via: ApprovalChannel, live: LiveDraft, answer: string, kind?: ApprovalKind, _platform?: NodeJS.Platform, options?: {
-    usedSaid?: UsedSaid | undefined;
-  }): Promise<ApprovalRecord>;
+  mode?: string | undefined;
   /**
-   * Claims the record for sending, once. Non-consuming refusals (not yet approved) leave the record untouched so the
-   * human can still approve it; integrity failures (another account, an edited or changed draft, different recipients
-   * or subject) void it. Success creates the O_EXCL claim marker.
+   * The loopback port the last sign-in used, which is the one in the app's redirect URL.
    *
-   * `live.inboxId` is the owner the caller claims for: a record of another owner is the one `NOT_FOUND`, and left as it
-   * is. The policy is the live gate's, from the configuration read under the record's lock (decision 4): a value the
-   * caller read before the lock is exactly what a `never` change can land between.
+   * Slack matches redirect URLs exactly, so every later sign-in and every set of steps that edits the app has to
+   * name this number. Without it the steps said `<port>`, or — from the MCP server — guessed 51234, and a person who
+   * had chosen another port followed them to a sign-in that failed on the way back.
    */
-  claimForSend(approvalId: string, live: LiveDraft & {
-    inboxId: string;
-    inboxSub?: string | undefined;
-    expect: Expectation;
-  }, options?: ClaimOptions): Promise<SendClaim>;
+  redirectPort?: number | undefined;
+  /** The organisation profile whose Slack app created this account. Absent for a person's own app. */
+  organisation?: string | undefined;
+  /** Which app in that profile issued the account's current credential. */
+  profileApp?: "read" | "send" | undefined;
+}
+type PendingRevocationStatus = "pending" | "revoked" | "expired";
+/** One bearer token in a superseded rotating bundle, tracked independently from its pair. */
+interface PendingRevocationTokenState {
+  status: PendingRevocationStatus;
+  /** The fixed absolute time after which the old token is known to be unusable. */
+  deadline: string;
+}
+/**
+ * A superseded credential kept until each token in it is conclusively revoked or expired.
+ *
+ * `store` belongs to the entry rather than being inferred from `secrets.store`: an older release can move the root
+ * store without knowing to move this bundle, and cleanup must still find the only copy that exists.
+ */
+interface PendingRevocation {
+  ref: string;
+  store: StoreKind;
+  platform: string;
+  workspace: string;
+  createdAt: string;
+  tokens: {
+    access: PendingRevocationTokenState;
+    refresh?: PendingRevocationTokenState | undefined;
+  };
+}
+interface ConfigBody {
   /**
-   * Renews the sending lease of a send this call claimed: writes `sendingHeartbeatAt` while the claim still owns a
-   * `sending` record, and nothing otherwise. `renewed` while it is sending; `lost` once it reads `unknown` (or anything
-   * else) — a renewal never moves a record back to `sending`. Refused, writing nothing, without the claim's token.
+   * The one secret backend for this config directory: client secrets, refresh tokens and the approval key. Absent
+   * until the first command that stores a secret chooses it.
    */
-  heartbeat(approvalId: string, claimToken: string): Promise<"renewed" | "lost">;
+  secrets?: {
+    store: StoreKind;
+  } | undefined;
+  clients: Record<string, ClientConfig>;
+  inboxes: Record<string, InboxConfig>;
+  /** Non-mail accounts. Absent in every config written before this key existed, hence the default. */
+  accounts: Record<string, AccountConfig>;
+  /** Superseded rotating credentials which still need conclusive per-token cleanup. */
+  pendingRevocations?: PendingRevocation[] | undefined;
+  defaults: Defaults;
   /**
-   * The check before each provider step (design 2026-10-05 §D1): `go`, with the lease renewed, while this claim still
-   * owns a `sending` record; `stop` once it reads `unknown` — another caller has decided its outcome cannot be known,
-   * and no further step may start. Refused, writing nothing, without the claim's token.
+   * How what an agent sends is labelled (design 2026-10-15-agent-label, L5): the word, the name, the rules that say
+   * who a message appears to come from, and each Slack account's agent emoji.
+   *
+   * `unknown` here, on purpose: it is read only through `agentLabelOf`, which reads a value it does not understand
+   * as the stricter one — an unknown word as `agent`, a rule list it cannot read as no rules — so a hand edit or a
+   * later release's key can only tighten. Kept through every write as the schemas keep every key they do not name, and
+   * judged by `classifyChange`.
    */
-  fence(approvalId: string, claimToken: string): Promise<"go" | "stop">;
+  agentLabel?: unknown;
   /**
-   * A change approval, pending, bound to `changeDigest(input.change)`.
+   * What an agent may do (design 2026-10-19-agent-behaviour-rules, B3): `{ rules: [...] }`, each rule the acts allowed
+   * in one account or one of its conversations.
    *
-   * The digest is computed here, never taken from the caller, so a record cannot claim to be bound to one change while
-   * describing another. It stands in for the draft revision too, as a reaction's does: a change has no draft, and the
-   * same value means the same change.
+   * `unknown` here, as `agentLabel` is, and for the same reason the other way round: it is read only through
+   * `readBehaviourSettings`, which reads a value it does not understand as allowing less — an unknown act dropped, a
+   * rule it cannot read as its account allowing nothing — never as no rules. Kept through every write as the schemas
+   * keep every key they do not name, so older releases keep it too, and judged by `classifyChange`.
    */
-  createChange(input: CreateChangeApprovalInput): Promise<ApprovalRecord>;
+  behaviour?: unknown;
+}
+interface ConfigV1 extends ConfigBody {
+  version: 1;
+}
+/** A name an account used to have, and the account that had it. */
+interface FormerName {
+  /** What it was renamed to — at the time. The account's current name is found by `id`, so a later rename is followed. */
+  name: string;
+  id: string;
+}
+/**
+ * Names that were replaced, per kind, and never reusable.
+ *
+ * Per kind because version 1 lets a mailbox and a workspace share a word: `work` the mailbox and `work` the workspace
+ * become `work/gmail` and `work/slack`, and one flat record could not say which old `work` is which.
+ */
+interface FormerNames {
+  inboxes: Record<string, FormerName>;
+  accounts: Record<string, FormerName>;
+}
+/** Who an organisation's Google client is for, as its administrator states it (design 2026-10-02 §D2). */
+type OrganisationServes = "any" | {
+  domains: string[];
+};
+/**
+ * One Google client an organisation profile brought here: a *generation* (design 2026-10-02 §D4).
+ *
+ * `owned` — the profile made the client row `name` (`rgc-1`), which carries `organisation`, and its secret is the
+ * profile's to rewrite. `adopted` — the row was already here under a name a person chose (they ran `client add` with
+ * the organisation's file), and stays theirs: no `org` command changes or removes it. `serves` is per generation,
+ * because it is a fact about one client, not about the organisation.
+ */
+interface OrganisationGeneration {
+  name: string;
+  clientId: string;
+  projectId?: string | undefined;
+  ownership: "owned" | "adopted";
+  serves: OrganisationServes;
+  addedAt: string;
+}
+interface OrganisationSlackApp {
+  clientId: string;
+  appId?: string | undefined;
+}
+/**
+ * An organisation's update caps, as the file beside its profile names them (design 2026-10-16, U8), and the SHA-256 of
+ * that file, so `org update` can tell the organisation changing them from the record drifting. A `max` word this release
+ * does not know reads as `never`, the strictest it could mean: caps only ever tighten.
+ */
+interface OrganisationUpdates {
+  max?: string | undefined;
+  background?: boolean | undefined;
+  sha256: string;
+}
+/**
+ * The organisation's bot-only agent app, as its profile's agent-app file names it (CUE-493): the app's id, and the
+ * SHA-256 of that file, so `org update` can tell the organisation changing it from the record drifting. No client id:
+ * nobody signs in through it — its administrator installs it once and its members paste its bot token.
+ */
+interface OrganisationAgentApp {
+  appId: string;
+  sha256: string;
+}
+/**
+ * What this machine records of one organisation profile: never its bytes and never its secret — where it was read
+ * from, the SHA-256 of what was read and when, the generations of its Google client, and its Slack apps.
+ */
+interface OrganisationRecord {
+  label: string;
+  /** Read again, from this absolute path, by every `org update`. `file` is the one kind version 1 knows (§D3). */
+  source: {
+    kind: string;
+    path: string;
+  };
+  sha256: string;
+  readAt: string;
+  addedAt: string;
+  /** Whether the member asked for this organisation's client to serve addresses outside it too (§D6). */
+  forOtherAddresses: boolean;
+  /** `active` names the generation new mailboxes get — none once a profile stops naming a Google client. */
+  gmail?: {
+    active: string | null;
+    generations: OrganisationGeneration[];
+  } | undefined;
+  slack?: {
+    workspace: string;
+    workspaceName: string;
+    redirectPort: number;
+    apps: {
+      read?: OrganisationSlackApp | undefined;
+      send?: OrganisationSlackApp | undefined;
+      agent?: OrganisationAgentApp | undefined;
+    };
+  } | undefined;
+  /** The organisation's update caps, from the file beside its profile; absent when it names none. */
+  updates?: OrganisationUpdates | undefined;
   /**
-   * Claims a change approval, once, for the change the caller is about to write.
-   *
-   * `live.change` is the change as the caller computes it now, and it has to digest to what was prepared: a different
-   * path, a different value, a different account or a different effect voids the approval, because the person agreed
-   * to something else. `live.policy` is the change policy in force now, and the stricter of it and the one at prepare
-   * decides — so tightening the policy after an agent prepared a change takes effect on that change, and loosening it
-   * does not release one prepared under `confirm`.
+   * The entries of the profile's `extensions` this release did not know and skipped, being optional (design 2026-10-19,
+   * X3): the release that first understands each, and the SHA-256 of the entry's canonical JSON — as
+   * `Record<string, OrganisationIgnoredExtension>`. Kept in step with the profile. Absent when none was skipped.
    *
-   * Under `chat` a pending approval is claimable: the yes was given in the conversation. Anything stricter needs a
-   * person to have typed the code at a terminal first; until then the refusal leaves the record as it is.
+   * Held as the file holds it, whatever its shape, and read only through `ignoredListOf`, which keeps the well-formed
+   * entries and names the rest: 0.21.0 is the first release to read it, so a shape a later release or a hand gave it
+   * must never make the whole configuration unreadable, nor be dropped by an unrelated write. Losing it is safe: a
+   * later release that understands an entry judges applying it by its classifier whether or not the list names it —
+   * a tightening at once, anything else approved first, never a repair of drift (X4).
    */
-  claimForChange(approvalId: string, live: LiveChange, options?: ClaimOptions): Promise<ApprovalRecord>;
+  ignoredExtensions?: unknown;
+}
+interface ConfigV2 extends ConfigBody {
+  version: 2;
+  formerNames: FormerNames;
   /**
-   * A download's question, pending, bound to `downloadDigest(input.download)` — computed here, never taken from the
-   * caller, as a change's digest is. It stands in for the draft revision too.
-   *
-   * `policy` is the change policy of the mailbox or workspace the files come from, as it stands when the question is
-   * asked: where a stranger's files land on this machine is a change to it, and is answered the way that account's
-   * other changes are approved. A claim holds the question to the stricter of this and the policy then.
+   * The organisation profiles added here, by organisation word (design 2026-10-02 §D4). Absent reads as none, and
+   * stays absent until the first `org add`: a key the schema filled in would be written into every file by the next
+   * unrelated change.
    */
-  createDownload(input: {
-    /** The manifest channel the files come from. */
-    channel: string;
-    download: DownloadBinding;
-    policy: ChangePolicy;
-  }): Promise<ApprovalRecord & {
-    download: DownloadBinding;
-  }>;
+  organisations?: Record<string, OrganisationRecord> | undefined;
+}
+/** What a legacy drain records of one tracked record: still open, or what became of it. */
+type LegacyDrainOutcome = "revoked" | "expired" | "used" | "failed" | "sending" | "unknown";
+/**
+ * The approvals an earlier release prepared that were still waiting, or already being sent, when this configuration
+ * became version 3, and what has become of each (design 2026-10-05 §D1, "Old releases are locked out before the fence
+ * is relied on").
+ */
+interface LegacyDrain {
+  /** When the conversion that opened the drain was written. */
+  since: string;
+  /**
+   * Every tracked version-1 send record by id: `open` until it has an outcome — or `sending` from the start, for one an
+   * earlier release was already sending when the conversion ran.
+   */
+  tracked: Record<string, "open" | LegacyDrainOutcome>;
+}
+/** What version 3 adds to a body of either naming. */
+interface Version3Fields {
+  /** Each owner's send epoch by id; absent reads as 0. Raised by every write that turns its send policy to `never`. */
+  sendEpochs?: Record<string, number> | undefined;
+  /**
+   * The standing epoch (design 2026-10-19-standing-approvals, S8); absent reads as 0. Raised by `standing off` and by
+   * every write that turns a change policy from `chat` to `confirm`, and never lowered: a standing approval made under
+   * an earlier one has ended.
+   */
+  standingEpoch?: number | undefined;
+  /** Present while records from an earlier release are being retired. */
+  legacyDrain?: LegacyDrain | undefined;
+}
+/** Version 3 over a version-1 body: one plain word per account. */
+interface ConfigV3Naming1 extends ConfigBody, Version3Fields {
+  version: 3;
+  naming: 1;
+}
+/** Version 3 over a version-2 body: `organisation/platform` names, and the names they replaced. */
+interface ConfigV3Naming2 extends Omit<ConfigV2, "version">, Version3Fields {
+  version: 3;
+  naming: 2;
+}
+/**
+ * Version 3: the send epoch and the legacy drain (design 2026-10-05 §D1), over either naming — converted from version 1
+ * or 2 without renaming anything, so its body keeps the rules of the version it came from.
+ */
+type ConfigV3 = ConfigV3Naming1 | ConfigV3Naming2;
+type Config$1 = ConfigV1 | ConfigV2 | ConfigV3;
+/** A configuration whose accounts are named `organisation/platform`: version 2, or version 3 over it. */
+type NamedConfig = ConfigV2 | ConfigV3Naming2;
+/** A configuration whose accounts have one plain word each: version 1, or version 3 over it. */
+type PlainConfig = ConfigV1 | ConfigV3Naming1;
+/** The committed config returned by an update; process-only commit metadata is deliberately stored out of band. */
+type ConfigUpdateResult = Config$1;
+declare class ConfigStore {
+  #private;
+  readonly path: string;
   /**
-   * Records the person's answer to a download's question, given where an agent cannot give it: at their own terminal,
-   * or in a form a trusted client showed them. The question moves to `approved`, carrying the answer, and waits for
-   * the download to claim it — which it may then do under `confirm`, and which saves where this answer says.
-   *
-   * Only a pending question can be answered, and only once: a second answer is refused, not taken over the first.
+   * @param options.handoffs the printing package's handoffs (`core.handoffs`, CUE-403), for the command a refusal
+   *   names; left out, a refusal that has to name one is a programming error (`requiredHandoffs`).
    */
-  answerDownload(approvalId: string, via: ApprovalChannel, answer: RecordedSaveAnswer, _platform?: NodeJS.Platform): Promise<ApprovalRecord & {
-    download: DownloadBinding;
-  }>;
+  constructor(configDir: string, options?: {
+    readonly handoffs?: CliHandoffs | undefined;
+    /** Test-only pauses inside the version-3 conversion (`config-hooks.ts`); unreachable from the package root. */
+    readonly [CONVERSION_HOOKS]?: ConversionHooks | undefined;
+  });
+  /** The current config; an empty one when the file does not exist yet. */
+  load(): Promise<Config$1>;
   /**
-   * Claims a download's question, once, for the download the caller is about to make — and returns it, with the
-   * folders it offered, so that `downloads` and `current` in the answer mean the paths the person read, and with the
-   * answer the person recorded, when they recorded one.
-   *
-   * `live` is the download as the caller computes it now: the same account, the same request, the same files under
-   * the same names — the person answered for those files and no others. Any other is refused, and the question left
-   * open, as it was: a second call that got an argument wrong is the agent's slip, not the person's, and voiding the
-   * question for it would make the person answer again for nothing. It still expires, and is claimed once.
-   *
-   * Whether it can be claimed is the download `claimable` matrix (`downloadClaimable`, design 2026-10-05 §D2), decided
-   * under the question's lock against the live change policy read there — never a policy the caller read before it.
-   * While both the policy the question was asked under and the live one are `chat`, a pending question is claimed
-   * with the answer the caller carries: the person gave it in the conversation, and it is never kept. Otherwise only a
-   * question the person answered at a terminal or in a trusted form can be claimed; a pending one is refused, and left
-   * as it is, so they can still answer it. One used, voided, expired or corrupt is refused for what it is.
-   *
-   * `options.signal` is the download's cancellation, asked under the lock as a send's is (`ClaimOptions.signal`): a
-   * download cancelled while this waited saves nothing and leaves the question open, the answer still unused.
+   * Read-modify-write under a lock, so a CLI command and a running MCP server never lose each other's changes. The
+   * mutator receives a fresh copy read inside the lock and returns the new config, which is validated before writing.
    */
-  claimForDownload(approvalId: string, live: DownloadRequest, options?: {
-    pendingHint?: string | undefined;
+  update(mutator: (config: Config$1) => Config$1 | Promise<Config$1>, options?: {
+    consent?: LooseningConsent;
     signal?: AbortSignal | undefined;
-    platform?: NodeJS.Platform | undefined;
-    handoffs?: CliHandoffs | undefined;
-  }): Promise<ApprovalRecord & {
-    download: DownloadBinding;
-  }>;
+  }): Promise<ConfigUpdateResult>;
   /**
-   * Records the outcome of the one send attempt: `used` with the provider's id for it, when the provider accepted it,
-   * or `failed`.
+   * The one way a version-1 config becomes version 2.
    *
-   * `used` needs a non-empty id. A provider that accepted a send without one has not given anything to record it by,
-   * so the record is left as it is — `sending`, and then `unknown` — rather than made `used` with an empty id that
-   * every later reader would take for one.
+   * Under the credentials lock and then the config lock — the order everything takes them in — so it cannot land
+   * between a removal's read and its write, or in the middle of moving secrets between backends.
    *
-   * Only the claimant records it, by its claim token, from `sending` or from `unknown`: a provider's answer that
-   * arrives after the lease ran out is still the truth. A late success clears the stale-lease reason; a late failure
-   * replaces it with its own.
-   */
-  complete(approvalId: string, claimToken: string, outcome: SendOutcome): Promise<ApprovalRecord>;
-  /**
-   * Voids a pending or approved record. Other records are left as they are, and returned as they read.
+   * `expected` is the fingerprint of the config the caller previewed. The file is read again inside the locks, and
+   * if it is not that config any more the whole thing is refused: somebody confirmed a mapping computed from
+   * something else. Nothing waits for a person while holding a lock; the preview happens before this is called.
    *
-   * `disposition` says whose decision this is, and has no default: every caller chooses (`RevokeDisposition`). A
-   * version-1 record is retired in its own shape when a person or an owner's removal revokes it (`revokeLegacy`), and
-   * refused with the version refusal, nothing written, when this release's integrity check would have voided it. A
-   * corrupt or unreadable record is never revoked or rewritten: it is refused with the integrity refusal, which repeats
-   * only its stub.
-   */
-  revoke(approvalId: string, reason: string, options: {
-    disposition: RevokeDisposition;
-    expect?: ApprovalExpectation | undefined;
-  }): Promise<StoredApproval>;
-  /**
-   * Retires a record from an earlier release (version 1) in that release's own shape, so a process still running it
-   * can no longer claim the record — and nothing more.
+   * `build` produces version 2 from the locked snapshot. What it may change is checked rather than trusted: the same
+   * accounts, byte for byte, under new keys — a rename grants nothing, so a build that changed anything else is a
+   * bug and is refused before it is written.
    *
-   * Under the record's own lock, `<id>.json.lock`, the one 0.13.0's transitions take, so the two serialise. The file
-   * is read again there, decoded, and its state derived by its own release's rules (`deriveLegacyV1State`). Only a
-   * `pending` or `approved` record is rewritten, as itself plus `state: 'revoked'`, the reason and `updatedAt`: its
-   * digest version stays 1, a send stays without a `kind`, and no field of this release's is added — no claim marker
-   * either. Any other derived state is returned as it reads and written nothing: an expired record is never rewritten,
-   * as `revoke` leaves every finished record as it is.
+   * Idempotent, but only for this plan. A retry after a write that committed — even one whose lock release then
+   * failed — finds version 2, recognises its own mapping in it, and says so. Version 2 that does *not* carry this
+   * mapping is somebody else's migration; saying "already migrated" there would report a mapping nobody applied,
+   * and a caller updating registrations from it would point them at names that do not exist.
    *
-   * It reads no configuration and needs no owner, so it works on a record whose account is already gone. Its only
-   * callers are a person's revoke, the removal of the record's owner, and the legacy drain.
-   */
-  revokeLegacy(approvalId: string, reason: string): Promise<LegacyApprovalRecord>;
-  /**
-   * Every approval file, each looked at under its own lock and classified there, as `inspect` looks at one — against one
-   * configuration snapshot, loaded once before any file is read (design 2026-10-05 §D2, §D8). What a list shows: each
-   * record's form and its outcome, nothing skipped. Like a look, it writes only what reading derives — an expiry at its
-   * boundary, a stale send's `unknown` — never a revocation: an owner removed or a stale epoch is shown as revoked, and
-   * written by the next action.
+   * `rows` is the plan, and the question is asked of the mapping rather than of the whole file: between a
+   * committed write and its retry, something else may have changed a policy or a timezone, and a retry refused
+   * over that would be idempotency in name only. The rows are checked here rather than by whoever built them,
+   * for the same reason `build` is: a caller that could answer its own question could answer it wrongly.
    *
-   * `inboxId` keeps the records whose owner is that id (`ownerOf`), so one whose owner cannot be trusted never matches;
-   * `states` keeps those whose classified state is listed — a stored state, `corrupt`, and for a download's answered
-   * question its stored `approved` or `used`.
+   * The file it replaces is copied beside it first — see `backUpBeforeMigration` — and the copy's path returned.
    */
-  inspectAll(filter?: {
-    inboxId?: string;
-    states?: (ApprovalState | "corrupt")[];
-  }): Promise<Array<{
-    stored: StoredApproval;
-    outcome: ApprovalOutcome;
-  }>>;
+  migrateNames(expected: string, rows: readonly RenamedAccount[], build: (current: PlainConfig) => NamedConfig): Promise<{
+    status: "migrated" | "already-migrated";
+    config: NamedConfig;
+    backup?: string;
+  }>;
   /**
-   * Every approval file, each in one of its four forms — nothing skipped, nothing omitted — read against one
-   * configuration snapshot, loaded once before any file is read: a loader that fails fails the whole list.
+   * The one way a configuration becomes version 3 (design 2026-10-05 §D1, "Old releases are locked out before the
+   * fence is relied on").
    *
-   * `inboxId` keeps the records whose owner is that id (`ownerOf`), so a file whose owner cannot be trusted never
-   * matches one; `states` keeps those whose state (`stateOf`, `corrupt` for one that cannot be used) is listed.
+   * Version 3 carries the send epoch, which 0.13 does not know, and 0.13 refuses to read it — so from this write on, no
+   * 0.13 process can start a prepare, a claim, an approval or a policy change through this file. Nothing is renamed:
+   * a version-1 body stays version 1's (`naming: 1`) until the names migration, which needs its own approval.
+   *
+   * Under the config lock, the file is read again — never from the cache, never from the read before the lock — and an
+   * existing version 3 returned unchanged: a second converter that lost the race keeps the winner's epochs and drain.
+   * `scan` runs under the same lock, so a record written while this waited for it is seen, and an update cannot land
+   * between the scan and the write; the version-3 write carries `legacyDrain` only when the scan tracked something.
+   * With no config file at all there is nothing to convert, and nothing is written.
    */
-  list(filter?: {
-    inboxId?: string;
-    states?: (ApprovalState | "corrupt")[];
-  }): Promise<StoredApproval[]>;
-}
-//#endregion
-//#region src/ledger.d.ts
-interface Caps {
-  perHour: number;
-  perDay: number;
-}
-interface CapStatus {
-  hour: number;
-  day: number;
-  /** When the next slot frees up, if a cap is reached. */
-  resetAt?: string;
+  convertToVersion3(scan: () => Promise<LegacyDrain["tracked"]>, options?: {
+    now?: (() => Date) | undefined;
+  }): Promise<{
+    status: "converted" | "already" | "empty";
+    config: Config$1;
+  }>;
 }
-declare class SendLedger {
-  #private;
-  readonly directory: string;
-  constructor(stateDir: string, now?: () => Date);
-  /** Counts sends (including in-flight reservations) in the last hour and day. */
-  status(inboxId: string, caps: Caps): Promise<CapStatus>;
-  /** Reserves a slot or refuses with APPROVAL_REQUIRED and the time the cap resets. Atomic across processes. */
-  reserve(inboxId: string, approvalId: string, caps: Caps): Promise<CapStatus>;
-  /** Releases a reservation whose send did not happen. */
-  release(inboxId: string, approvalId: string): Promise<void>;
+/** One account's rename, as the migration planned it. */
+interface RenamedAccount {
+  readonly kind: "inbox" | "account";
+  readonly from: string;
+  readonly to: string;
+  readonly id: string;
 }
-//#endregion
-//#region src/plans.d.ts
+/** A value a loosened setting had or will have: a policy, a mode, a list, a pair of caps, a path, or nothing. */
+type SettingValue = string | number | boolean | readonly string[] | {
+  readonly [key: string]: unknown;
+} | null;
 /**
- * Bulk mailbox changes (more than 20 messages, anything driven by a query, and every trash) are two-step: a dry run
- * returns a plan token bound to the exact set of ids and the exact change; executing requires that token, once, within
- * ten minutes. The ids are resolved at dry-run time, so a query cannot silently grow between preview and execution.
+ * One loosened setting, with the values the classifier compared.
+ *
+ * The values are the ones it judged, not the raw fields: an inbox that inherits a looser default reports the policy
+ * it inherits, and a new inbox reports the default it was measured against. A preview built from anything else could
+ * show a person one change while the classifier judged another.
  */
-interface PlanRecord {
-  token: string;
-  inboxId: string;
-  operation: string;
-  /** Digest of the operation parameters (labels added/removed, archive, trash…). */
-  paramsDigest: string;
-  /** Digest of the sorted id list. */
-  idsDigest: string;
-  count: number;
-  createdAt: string;
-  expiresAt: string;
-}
-declare class PlanStore {
-  #private;
-  readonly directory: string;
-  constructor(stateDir: string, now?: () => Date);
-  create(input: {
-    inboxId: string;
-    operation: string;
-    params: unknown;
-    ids: readonly string[];
-  }): Promise<PlanRecord>;
+interface Loosening {
+  /** As `ConfigStore.update` names it in a refusal: `accounts.rgc/slack.mode`, `defaults.sendPolicy`. */
+  readonly path: string;
+  readonly before: SettingValue;
+  readonly after: SettingValue;
   /**
-   * Consumes a plan exactly once. It must be for the same inbox, operation, parameters and ids; the file is deleted
-   * inside the lock, so a second consume fails.
+   * The inbox or account measured on the before side, by id. Absent for one new in this change and for a setting
+   * that belongs to the whole configuration. Carried so that an approval of this loosening cannot be spent on a
+   * different account that took the same name in the meantime.
    */
-  consume(token: string, expected: {
-    inboxId: string;
-    operation: string;
-    params: unknown;
-    ids: readonly string[];
-  }): Promise<PlanRecord>;
+  readonly id?: string | undefined;
 }
-//#endregion
-//#region src/secrets.d.ts
 /**
- * Where refresh tokens, client secrets and approval keys live. Two backends, chosen per inbox or client and recorded
- * in config; the choice is never switched at runtime and there is no silent fallback from one to the other.
+ * One setting a change writes, from the value in the file before to the value after — whichever way it moves.
  *
- * - `keychain`: the OS store (macOS Keychain, Windows Credential Manager, Linux Secret Service — pinned, never the
- *   kernel keyring, which forgets everything on reboot) through the optional `@napi-rs/keyring` package.
- * - `file`: one owner-only JSON file per secret in an owner-only directory. Chosen explicitly, never by default.
+ * Unlike a `Loosening`, these are the raw values, not the effective ones: `null` for a setting the file does not
+ * hold, so a mailbox set to `chat` itself is told apart from one inheriting `chat`, which only the first survives a
+ * later change to the default. `id` is the inbox or account measured on the before side, as for a loosening.
  */
-type SecretStoreKind = "keychain" | "file";
-interface SecretStore {
-  readonly kind: SecretStoreKind;
-  get(ref: string): Promise<string | null>;
-  set(ref: string, value: string): Promise<void>;
-  delete(ref: string): Promise<boolean>;
-  /** Forgets any cached value, so the next read goes to the backend (e.g. after another process re-authorised). */
-  invalidate(ref: string): void;
+interface SettingChange {
+  readonly path: string;
+  readonly before: SettingValue;
+  readonly after: SettingValue;
+  readonly id?: string | undefined;
+}
+/**
+ * Proof that exactly these paths may loosen: produced by a CLI after a person at a terminal typed a challenge, or by
+ * `claimChange` from a change approval a person gave.
+ */
+interface LooseningConsent {
+  kind: "loosening-consent";
+  paths: readonly string[];
   /**
-   * Resolves once no earlier call is still occupying the backend. Absent on a store with nothing to wait for.
+   * What each path was approved to move between, when the consent came from a change approval.
    *
-   * For a caller that must not give up on a write: the keychain fails every call fast while a timed-out native call
-   * is still held by an OS dialog, so retrying on a timer spends every attempt against the same stuck call. A
-   * refresh that has already spent Slack's single-use token is that caller — it has one value it cannot get again,
-   * and waiting for the dialog to be answered is the only retry that can succeed.
+   * A terminal challenge is answered moments before the write it permits, so the paths are enough. An approval is
+   * prepared first and applied later — after a sign-in, possibly minutes later — and in between the configuration
+   * can move underneath it: the same path, loosened from a different value, or on a different account that took
+   * the name. With these, `ConfigStore.update` refuses any loosening that is not exactly one of them.
    */
-  settled?(): Promise<void>;
+  changes?: readonly Loosening[] | undefined;
 }
 //#endregion
-//#region src/state.d.ts
-/**
- * Per-inbox runtime facts that any process may update (last successful refresh, last use, health). Kept out of
- * config.json so a running server never rewrites user intent — a stale in-memory copy of config written back by a
- * server could otherwise silently undo a policy the user just tightened.
- */
-interface InboxRuntimeState {
-  lastRefreshOkAt?: string | undefined;
-  lastUsedAt?: string | undefined;
-  /** Set to `undefined` to clear it: the merged value is dropped when the file is written. */
-  lastError?: {
-    code: string;
-    message: string;
-    at: string;
-  } | undefined;
-  grantedScopes?: string[] | undefined;
-  refreshTokenExpiresAt?: string | undefined;
-}
-declare class InboxStateStore {
-  #private;
-  readonly directory: string;
-  constructor(stateDir: string);
-  get(inboxId: string): Promise<InboxRuntimeState>;
-  /** Merges `patch` into the stored state under a per-inbox lock. */
-  update(inboxId: string, patch: Partial<InboxRuntimeState>): Promise<InboxRuntimeState>;
-}
+//#region src/cli-command.d.ts
 /**
- * A platform identifier that is not an email address: a Slack user or conversation id.
+ * The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
  *
- * It carries its scope because, unlike an address, it is not globally unique — `U024BE7LH` names a different person
- * in every workspace that happens to mint that id. The address store is deliberately cross-inbox, on the reasoning
- * that a message read in one mailbox can ask for a send from another; that reasoning does not transfer here, and a
- * store that matched ids across workspaces would flag an unrelated person every time two workspaces collided.
+ * A bare `agent-gmail approve …` is not runnable for most of the people it is printed for: a package run by npx, by a
+ * managed runtime or from a checkout puts nothing on their PATH. So every such command names this process's Node and
+ * a checked file of the product it runs, with the suite directories it uses pinned as options — and when no file can
+ * be checked, there is no command at all, only a sentence saying what is missing. The caller says which package it is
+ * and what to run; it never supplies the program or quotes the line.
  *
- * The id, never the display name. `@sam` is set by the account that bears it and can be changed to `@finance-bot`
- * between the message being read and the send being checked; the id cannot.
+ * Three directions. A product's own CLI is found from the product itself, walking from one of its own modules to its
+ * manifest: no registration is ever asked. A channel's handoff to core is found the way the channel itself finds core,
+ * through its installed dependency, and only the same release. Another product's command is found among the servers
+ * registered with the person's MCP clients, which the caller scanned and passes in: only a file-backed registration of
+ * exactly the printing package's version, checked on disk. Nothing a registration names is run, or asked anything —
+ * not even its interpreter for a version: no installer wrote down where a scanned entry came from, so none is trusted
+ * to run (D1). This module never scans, spawns or probes.
+ *
+ * What is checked is checked when the command is printed, not for ever (D6): the file it names is real, readable and
+ * inside its package then, and a later change to that installation is a later fact.
  */
-interface TaintHandle {
-  /** `slack`. Lower-cased on the way in. */
-  platform: string;
-  /** The workspace or team the id belongs to — a Slack team id. */
-  scope: string;
-  /** `U024BE7LH`, `C0123`, `D0456`. Passed in the platform's own canonical form; core does not know its shape. */
-  id: string;
-}
-type TaintSource = "header" | "body";
-/** Why the content reached this process. This is separate from `TaintSource`, which remains the cap priority. */
-type TaintOrigin = "read" | "event";
-interface TaintObservation {
-  address: string;
-  source: TaintSource;
-  /** Old readers did not record this, so an omitted origin remains an ordinary read. */
-  origin?: TaintOrigin | undefined;
-  inboxId: string;
-  messageId?: string | undefined;
-}
-/** The same observation for a handle. `inboxId` is the account that did the reading, as it is for an address. */
-interface TaintHandleObservation {
-  handle: TaintHandle;
-  source: TaintSource;
-  /** Old readers did not record this, so an omitted origin remains an ordinary read. */
-  origin?: TaintOrigin | undefined;
-  inboxId: string;
-  messageId?: string | undefined;
-}
-/** What is never recorded: the user's own addresses and the domains they call internal. */
-interface TaintExclusions {
-  ownAddresses: readonly string[];
-  internalDomains: readonly string[];
-  /**
-   * Handles that are never recorded: the account's own user id, and whoever the caller treats as internal — the
-   * counterpart of `internalDomains`, decided per platform because "internal" means a domain for mail and
-   * workspace membership for Slack, and core should not be the thing that knows the difference.
-   */
-  ownHandles?: readonly TaintHandle[] | undefined;
-}
+/** The gate a constructor call has to pass: only this module holds it. */
+declare const GATE: unique symbol;
 /**
- * One stored aggregate, exactly as the store holds it (design 2026-10-05 §D4): the newest time anything matched it, the
- * strongest source ever seen — `header` is kept once seen — and every mailbox that recorded it. Three separate facts,
- * never one sighting: `touch` replaces the time, keeps a header and unions the mailboxes independently.
+ * A command that runs one of this suite's own CLIs, made only by `locateCliCommand`. Rendered as every printed command
+ * is — a line to paste, or on Windows its words as JSON when no line is safe in every shell (`inlineCommand`,
+ * `commandText`).
+ *
+ * A class with a private field, so the type is nominal: an object literal with the same fields is not one, and nor is
+ * a spread copy of one with other words in it, as it would be with a symbol-keyed brand. Only the type is exported;
+ * the class and its gate are not.
  */
-interface TaintAggregate {
-  readonly at: string;
-  readonly source: TaintSource;
-  readonly inboxIds: readonly string[];
-  /** Sorted, duplicate-free provenance. A base entry with no sidecar record is a legacy read. */
-  readonly origins: readonly TaintOrigin[];
-}
-interface TaintCheck {
-  address: boolean;
-  domain: boolean;
-  /** The exact address's aggregate, when it is in the window. */
-  addressSeen?: TaintAggregate | undefined;
-  /** Its domain's, when that counts — not a public mailbox provider — and is in the window. */
-  domainSeen?: TaintAggregate | undefined;
-}
-/** Testable interruption point for the crash-safe, two-lock sidecar protocol. */
-interface TaintStoreHooks {
-  afterOriginsCommit?: (() => Promise<void>) | undefined;
-  onLockAcquired?: ((lock: "origins" | "taint" | "handles") => void) | undefined;
-}
-declare class TaintStore {
+declare class PrintedCommand {
   #private;
-  readonly directory: string;
-  constructor(stateDir: string, now?: () => Date, hooks?: TaintStoreHooks);
-  /**
-   * Records observations. Throws if it cannot — callers must fail the read rather than return content whose taint
-   * was not recorded.
-   */
-  record(observations: readonly TaintObservation[], exclusions: TaintExclusions, handleObservations?: readonly TaintHandleObservation[]): Promise<void>;
+  /** The words, as the program is to receive them: this Node, its flags, the entry, then the CLI's own words. */
+  readonly words: readonly string[];
+  /** The line to paste; null when no supported common or labelled shell rendering is safe. */
+  readonly line: string | null;
+  readonly platform: NodeJS.Platform;
+  readonly shell?: "powershell" | undefined;
+  constructor(gate: typeof GATE, words: readonly string[], platform: NodeJS.Platform, entry: string);
   /**
-   * Whether an address, or its (non-public) domain, was seen in email content in the window — from any inbox — and the
-   * aggregate each match is made of, for a caller to explain it. Nothing is written.
+   * The real path of the file it runs, as it was checked when the command was located: a fact about then (D6). The
+   * command names this path and nothing else, so what runs is whatever is there when the person runs it.
    */
-  check(address: string): Promise<TaintCheck>;
+  get entry(): string;
   /**
-   * Whether a handle was seen in message content in the window.
-   *
-   * Only within its own workspace — see `TaintHandle`. There is no second answer to give, the way an address also
-   * carries a domain: two ids sharing a workspace says nothing about either of them.
+   * As JSON — a result's field written out by `--json`, or returned to an MCP client — it is the text it always was:
+   * its line, or its words as JSON with what to do when no Windows line is safe (`commandText`). Rendered where it
+   * leaves the process, so a field can hold the command itself and the wire stays the same.
    */
-  checkHandle(handle: TaintHandle): Promise<boolean>;
-  /** The merged provenance of a retained handle, or no origins when it is not in the taint window. */
-  checkHandleOrigins(handle: TaintHandle): Promise<readonly TaintOrigin[]>;
+  toJSON(): string;
+  /** Never interpolated: a sentence gives a command through `handoffSentence`, a value through `handoffText`. */
+  [Symbol.toPrimitive](): never;
 }
-//#endregion
-//#region src/core.d.ts
-/** Everything a provider package needs from the core, wired to one config directory. */
-interface Core {
-  paths: ResolvedPaths;
-  /** The subset of `paths` explicitly pinned by global CLI options. */
-  pathOverrides: Readonly<PathOverrides>;
-  config: ConfigStore;
-  states: InboxStateStore;
-  approvals: ApprovalStore;
-  ledger: SendLedger;
-  plans: PlanStore;
-  taint: TaintStore;
-  audit: AuditLog;
-  /** Opens the config directory's one secret backend (as recorded in config, or `kind` before the first write). */
-  secrets(kind?: SecretStoreKind): Promise<SecretStore>;
-  /**
-   * The commands this process tells a person to run — its own CLI's, core's, another product's — located from the
-   * caller it was opened with (`OpenCoreOptions.caller`), for these folders. Undefined when none was given: then there
-   * is no command to print at all, and anything that asks for one meets the programming error `requireHandoffs` throws —
-   * never a bare name. Every package opens core with its caller.
-   */
-  handoffs?: CliHandoffs | undefined;
+/** The package asking: a module of its own (`import.meta.url`), and the package that module is expected to be in. */
+interface CliCommandCaller {
+  readonly url: string;
+  readonly packageName: string;
+}
+/** Why there is no command: the step that found nothing it could check. */
+type CliNotLocatedReason = "caller" | "manifest" | "core" | "version" | "engine" | "bin" | "entry" | "interpreter" | "arguments" | "direction" | "no-registrations" | "not-registered";
+/** Why one registration of the product was not used. */
+type RegistrationRejection = "npx" | "arguments" | "no-file" | "no-package" | "version" | "engine" | "bin" | "entry";
+interface RegistrationNotUsed {
+  readonly client: string;
+  readonly path: string;
+  readonly name: string;
+  readonly why: RegistrationRejection;
+}
+/**
+ * No command: nothing to run, and a sentence naming the product, its package and the exact version it needs. An
+ * installation that has gone or changed since is said so, never replaced by a suite command found by name on PATH.
+ */
+interface CliCommandNotLocated {
+  readonly ok: false;
+  readonly reason: CliNotLocatedReason;
+  /** How the product is named to a person: `Gmail`. */
+  readonly product: string;
+  readonly package: string;
+  /** The exact version needed: the printing package's own, since the suite is released together. */
+  readonly version: string;
+  /** For `engine`: the Node range the target declares. */
+  readonly nodeRange?: string | undefined;
+  /** For another product: each registration of it that was looked at, and why it was not used. */
+  readonly registrations?: readonly RegistrationNotUsed[] | undefined;
+  /** What was found, in a clause. */
+  readonly detail: string;
+  /** The whole sentence to show. */
+  readonly message: string;
 }
 //#endregion
 //#region ../core/dist/index.d.mts