@agentcomms/resend 0.22.0 → 0.23.0

package/dist/{send-BopELDLH.mjs → send-Dnq7bTQn.mjs}

@@ -12,7 +12,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$2 = "0.22.0";
+const VERSION$2 = "0.23.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -201,7 +201,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-DQ7AAwLg.mjs
+//#region ../core/dist/update-check-BrR1qAfk.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -269,6 +269,16 @@ const ERROR_REGISTRY = {
 		retryable: false,
 		summary: "a behaviour rule does not allow this act here"
 	},
+	STANDING_REFUSED: {
+		exit: EXIT_CODES.APPROVAL,
+		retryable: false,
+		summary: "this standing approval does not cover this act"
+	},
+	STANDING_LIMIT: {
+		exit: EXIT_CODES.APPROVAL,
+		retryable: false,
+		summary: "a standing approval's limit is reached"
+	},
 	RATE_CAPPED: {
 		exit: EXIT_CODES.APPROVAL,
 		retryable: true,
@@ -1276,6 +1286,9 @@ function labelPhrase(name, word, limit) {
 	if ([...phrase].length > limit) throw new CommsError("USAGE", `the label "${phrase}" is longer than this platform's ${limit} characters`, { hint: "Set a shorter name with `label name`." });
 	return phrase;
 }
+/** `<name> (<word>)`: a name holds no parenthesis or line break (`nameProblem`), so the first `(` is the word's. */
+const LABEL_PATTERN = `[^()\\n]{1,160} \\((?:${AGENT_LABEL_WORDS.map((word) => word.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\)`;
+new RegExp(`^\\s*(?:${LABEL_PATTERN}: |Sent by ${LABEL_PATTERN}(?:$|\\s))`, "iu");
 /** L3's sentence for an unlabelled message, the first line of its preview. */
 const UNLABELLED_PREVIEW_LINE = "Sent as you, with no label: it will look as if you wrote it yourself";
 function addressMatches(pattern, address) {
@@ -1728,12 +1741,17 @@ function sameDisclosureBinding(left, right) {
 		return false;
 	}
 }
-/** The lifetime profile, in milliseconds: pending on each route, approved, and a download's question. */
+/**
+* The lifetime profile, in milliseconds: pending on each route, approved, a download's question, and a standing
+* approval's child — usable once, within two minutes of the use that minted it. A standing record's own approved
+* lifetime is its days (`approvedMs`, checked against its limits), not one of these.
+*/
 const APPROVAL_LIFETIMES = Object.freeze({
 	chat: 6e5,
 	confirm: 18e5,
 	approved: 864e5,
-	download: 18e5
+	download: 18e5,
+	standingChild: 12e4
 });
 /**
 * The sending lease (design 2026-10-05 §D1): a `sending` record whose claimant has not renewed it for this long reads
@@ -1754,8 +1772,9 @@ function unknownAtOf(record) {
 	const at = Date.parse(renewed);
 	return Number.isFinite(at) ? new Date(at + SENDING_LEASE_MS).toISOString() : void 0;
 }
-/** How long a pending send or change on `route` stays open. */
+/** How long a pending send or change on `route` stays open; a standing child is never pending, and lasts its own. */
 function pendingMsOf(route) {
+	if (route === "standing") return APPROVAL_LIFETIMES.standingChild;
 	return route === "confirm" ? APPROVAL_LIFETIMES.confirm : APPROVAL_LIFETIMES.chat;
 }
 /** Whether `channel` is one this release knows: a manifest channel of the generated snapshot. */
@@ -1766,9 +1785,20 @@ function isKnownChannel(channel) {
 function requireKnownChannel(channel) {
 	if (!isKnownChannel(channel)) throw new CommsError("UNEXPECTED", `an approval cannot be made for the channel "${channel}": this release does not know it`, { hint: "This is a bug — please report it." });
 }
+/** Why `use` is not a child's use of its standing approval, or null: three strings, its content a SHA-256. */
+function standingUseProblem(use) {
+	if (typeof use !== "object" || use === null || Array.isArray(use)) return "it names no use";
+	const fields = use;
+	if (Object.keys(fields).some((key) => key !== "channel" && key !== "thread" && key !== "content")) return "it names more than its use";
+	for (const field of ["channel", "thread"]) if (typeof fields[field] !== "string" || fields[field] === "") return `its use has no ${field}`;
+	if (typeof fields.content !== "string" || !/^[0-9a-f]{64}$/.test(fields.content)) return "its use names no content";
+	return null;
+}
 /**
 * The identity a record is bound to, exactly as stored. An absent `inboxSub` is left out rather than kept as
-* `undefined`; a send always carries its epoch.
+* `undefined`; a send and a standing record always carry their send epoch. A standing record and its children carry
+* the standing epoch, and a child its standing id — each only when present, so every other record's identity, and its
+* digest, is exactly what it was before standing approvals existed.
 */
 function identityOf(record) {
 	return {
@@ -1785,7 +1815,14 @@ function identityOf(record) {
 			bcc: [...record.expect.bcc],
 			subject: record.expect.subject
 		},
-		...record.kind === "send" ? { sendEpoch: record.sendEpoch } : {}
+		...record.kind === "send" || record.kind === "standing" ? { sendEpoch: record.sendEpoch } : {},
+		...record.standingEpoch === void 0 ? {} : { standingEpoch: record.standingEpoch },
+		...record.standingId === void 0 ? {} : { standingId: record.standingId },
+		...record.standingUse === void 0 ? {} : { standingUse: {
+			channel: record.standingUse.channel,
+			thread: record.standingUse.thread,
+			content: record.standingUse.content
+		} }
 	};
 }
 /** One listed file, as stored: its name and size, and its rename reason and flags only when it has them. */
@@ -3295,12 +3332,12 @@ function collectFromJson(parsed, client, path, topScope = "user") {
 function collectFromToml(text, client, path) {
 	const servers = parseToml(text).mcp_servers;
 	if (servers === void 0) return [];
-	if (!isRecord$1(servers)) throw new TomlError("mcp_servers is not a table");
+	if (!isRecord$2(servers)) throw new TomlError("mcp_servers is not a table");
 	const found = [];
 	for (const [name, entry] of Object.entries(servers)) {
-		if (!isRecord$1(entry)) throw new TomlError(`mcp_servers.${name} is not a table`);
+		if (!isRecord$2(entry)) throw new TomlError(`mcp_servers.${name} is not a table`);
 		if (entry.args !== void 0 && !Array.isArray(entry.args)) throw new TomlError(`mcp_servers.${name}.args is not an array`);
-		if (entry.env !== void 0 && !isRecord$1(entry.env)) throw new TomlError(`mcp_servers.${name}.env is not a table`);
+		if (entry.env !== void 0 && !isRecord$2(entry.env)) throw new TomlError(`mcp_servers.${name}.env is not a table`);
 		found.push({
 			client,
 			path,
@@ -3308,12 +3345,12 @@ function collectFromToml(text, client, path) {
 			command: typeof entry.command === "string" ? entry.command : "",
 			args: Array.isArray(entry.args) ? entry.args.map(String) : [],
 			...typeof entry.url === "string" ? { url: entry.url } : {},
-			...isRecord$1(entry.env) ? { env: Object.fromEntries(Object.entries(entry.env).map(([key, value]) => [key, String(value)])) } : {}
+			...isRecord$2(entry.env) ? { env: Object.fromEntries(Object.entries(entry.env).map(([key, value]) => [key, String(value)])) } : {}
 		});
 	}
 	return found;
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -3326,8 +3363,8 @@ function isRecord$1(value) {
 */
 function codexServerFromGet(name, stdout, path) {
 	const answer = JSON.parse(stdout);
-	if (!isRecord$1(answer)) throw new SyntaxError("not an object");
-	const entry = isRecord$1(answer.transport) ? answer.transport : answer;
+	if (!isRecord$2(answer)) throw new SyntaxError("not an object");
+	const entry = isRecord$2(answer.transport) ? answer.transport : answer;
 	const command = typeof entry.command === "string" ? entry.command : "";
 	const url = typeof entry.url === "string" ? entry.url : void 0;
 	if (!command && !url) throw new SyntaxError("neither a command nor a URL");
@@ -3339,7 +3376,7 @@ function codexServerFromGet(name, stdout, path) {
 		command,
 		args: Array.isArray(entry.args) ? entry.args.map(String) : [],
 		...url ? { url } : {},
-		...isRecord$1(entry.env) ? { env: Object.fromEntries(Object.entries(entry.env).map(([key, value]) => [key, String(value)])) } : {}
+		...isRecord$2(entry.env) ? { env: Object.fromEntries(Object.entries(entry.env).map(([key, value]) => [key, String(value)])) } : {}
 	};
 	return {
 		...server,
@@ -3445,7 +3482,7 @@ async function scanRegisteredServers(env = process.env, platform = process.platf
 			continue;
 		}
 		add(collectFromJson(parsed, file.client, file.path));
-		if (file.client !== "claude-code" || !isRecord$1(parsed) || !isRecord$1(parsed.projects)) continue;
+		if (file.client !== "claude-code" || !isRecord$2(parsed) || !isRecord$2(parsed.projects)) continue;
 		for (const root of Object.keys(parsed.projects)) {
 			if (!isAbsolute(root)) continue;
 			const path = join(root, ".mcp.json");
@@ -6429,7 +6466,7 @@ const BEHAVIOUR_ACTS = Object.freeze([
 function isBehaviourAct(value) {
 	return typeof value === "string" && BEHAVIOUR_ACTS.includes(value);
 }
-function isRecord$2(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -6476,7 +6513,7 @@ function accountNamed(written, names) {
 /** One stored rule, or why it cannot be read. Reasons are fixed words: nothing from the file is repeated in them. */
 function readRule(raw, index, names) {
 	const at = `rule ${index + 1}`;
-	if (!isRecord$2(raw)) return { unreadable: {
+	if (!isRecord$1(raw)) return { unreadable: {
 		account: null,
 		reason: `${at} is not an object`
 	} };
@@ -6532,7 +6569,7 @@ function readBehaviourSettings(config) {
 			rules: [],
 			unreadable: []
 		};
-		if (!isRecord$2(stored)) return unreadableWhole("the behaviour setting is not an object");
+		if (!isRecord$1(stored)) return unreadableWhole("the behaviour setting is not an object");
 		const rules = stored.rules;
 		if (rules === void 0) return {
 			rules: [],
@@ -6909,7 +6946,7 @@ const SHOWN_WIDTH = 120;
 * space, and cut to `SHOWN_WIDTH`. As `shownText` shows a profile's text, which this module cannot import: its module
 * reads the configuration, and the configuration imports this one.
 */
-function shownName(value) {
+function shownName$1(value) {
 	const flat = neutralise(value).text.replace(/[\n\t]+/g, " ");
 	const chars = [...flat];
 	return chars.length <= SHOWN_WIDTH ? flat : `${chars.slice(0, 119).join("")}…`;
@@ -6922,20 +6959,20 @@ function shownName(value) {
 * act, the place and the rule as the decision holds them, made safe the same way.
 */
 function actNotAllowed(decision, shown, hint) {
-	const account = shownName(shown.account);
+	const account = shownName$1(shown.account);
 	const named = shown.place ?? decision.place;
-	const where = named === null ? `in ${account}` : `in ${shownName(named)} (${account})`;
+	const where = named === null ? `in ${account}` : `in ${shownName$1(named)} (${account})`;
 	const message = decision.allowedActs.length === 0 ? `this agent may do nothing ${where}` : `this agent may only ${inWords(decision.allowedActs)} ${where}`;
-	const rule = decision.rule.conversation === void 0 ? { account: shownName(decision.rule.account) } : {
-		account: shownName(decision.rule.account),
-		conversation: shownName(decision.rule.conversation)
+	const rule = decision.rule.conversation === void 0 ? { account: shownName$1(decision.rule.account) } : {
+		account: shownName$1(decision.rule.account),
+		conversation: shownName$1(decision.rule.conversation)
 	};
 	return new CommsError("ACT_NOT_ALLOWED", message, {
 		hint,
 		details: {
 			act: decision.act,
 			account,
-			place: decision.place === null ? null : shownName(decision.place),
+			place: decision.place === null ? null : shownName$1(decision.place),
 			rule,
 			allowedActs: [...decision.allowedActs]
 		}
@@ -6963,8 +7000,8 @@ function allowedHereLine(decision, shown) {
 	const acts = decision.allowedActs;
 	const allowed = acts === "all" ? "everything" : acts.length === 0 ? "nothing" : acts.join(", ");
 	const conversation = decision.rule.conversation;
-	const place = conversation === void 0 ? "" : `, ${shownName(shown.place ?? conversation)}`;
-	return `Allowed here: ${allowed} (rule: ${shownName(shown.account)}${place})`;
+	const place = conversation === void 0 ? "" : `, ${shownName$1(shown.place ?? conversation)}`;
+	return `Allowed here: ${allowed} (rule: ${shownName$1(shown.account)}${place})`;
 }
 /**
 * `config.behaviour` with every rule that holds the account `id` renamed from `from` to `to` (design
@@ -6979,7 +7016,7 @@ function allowedHereLine(decision, shown) {
 */
 function behaviourRenamed(config, id, from, to) {
 	const stored = config.behaviour;
-	if (!isRecord$2(stored)) return stored;
+	if (!isRecord$1(stored)) return stored;
 	const rules = stored.rules;
 	if (!Array.isArray(rules)) return stored;
 	const held = new Set([...Object.values(config.inboxes ?? {}), ...Object.values(config.accounts ?? {})].map((entry) => entry.id));
@@ -6990,7 +7027,7 @@ function behaviourRenamed(config, id, from, to) {
 	};
 	return {
 		...stored,
-		rules: rules.map((rule) => isRecord$2(rule) && holds(rule) ? {
+		rules: rules.map((rule) => isRecord$1(rule) && holds(rule) ? {
 			...rule,
 			account: to
 		} : rule)
@@ -7567,6 +7604,7 @@ const configV2Schema = looseObject({
 /** What version 3 adds, loose as the rest of the file is: a later release's keys inside them are kept. */
 const v3Shape = {
 	sendEpochs: record(string().min(1), number().int().min(0)).optional(),
+	standingEpoch: number().int().min(0).optional(),
 	legacyDrain: looseObject({
 		since: absoluteTimeSchema,
 		tracked: record(string().min(1), _enum(["open", ...[
@@ -7850,7 +7888,7 @@ var ConfigStore = class {
 						});
 					}
 				}
-				const written = withSendEpochs(current, parsed.data);
+				const written = withStandingEpoch(current, withSendEpochs(current, parsed.data));
 				const serialized = `${JSON.stringify(written, null, 2)}\n`;
 				await writeFileAtomic(this.path, serialized, 384, options.signal);
 				committed = written;
@@ -8033,6 +8071,46 @@ function withSendEpochs(before, after) {
 		sendEpochs: epochs
 	};
 }
+/**
+* The standing epoch in `config` (design 2026-10-19-standing-approvals, S8): its stored value, or 0 when it has none —
+* or when it is not a whole number of 0 or more, which no write of this release leaves.
+*/
+function standingEpochOf(config) {
+	const epoch = config.standingEpoch;
+	return typeof epoch === "number" && Number.isInteger(epoch) && epoch >= 0 ? epoch : 0;
+}
+/** The change policy of every inbox and account by id, each its own or the default. */
+function changePoliciesById(config) {
+	const policies = /* @__PURE__ */ new Map();
+	for (const inbox of Object.values(config.inboxes)) policies.set(inbox.id, inbox.changePolicy ?? defaultChangePolicy(config));
+	for (const account of Object.values(config.accounts)) policies.set(account.id, account.changePolicy ?? defaultChangePolicy(config));
+	return policies;
+}
+/**
+* Whether this write turns a change policy from `chat` to `confirm`: the default's, or the effective one of an inbox or
+* account there before and after, by id.
+*/
+function tightensAChangePolicy(before, after) {
+	if (defaultChangePolicy(before) === "chat" && defaultChangePolicy(after) === "confirm") return true;
+	const was = changePoliciesById(before);
+	for (const [id, policy] of changePoliciesById(after)) if (policy === "confirm" && was.get(id) === "chat") return true;
+	return false;
+}
+/**
+* `after`, with the standing epoch this write owes (design 2026-10-19-standing-approvals, S8): on version 3, the higher
+* of the two it holds — never lowered, whatever the write's own copy says, nor dropped — and one more when it tightens a
+* change policy (`tightensAChangePolicy`). Before version 3 there is no epoch, and no standing approval: every one is
+* made on version 3.
+*/
+function withStandingEpoch(before, after) {
+	if (before.version !== 3 || after.version !== 3) return after;
+	const held = Math.max(standingEpochOf(before), standingEpochOf(after));
+	const kept = tightensAChangePolicy(before, after) ? held + 1 : held;
+	return kept === 0 && after.standingEpoch === void 0 ? after : {
+		...after,
+		standingEpoch: kept
+	};
+}
 async function readFileIfExists(path) {
 	try {
 		return await readFile(path, "utf8");
@@ -8717,23 +8795,53 @@ function ownerEntry(config, ownerId) {
 */
 function liveGateOf(config, record) {
 	const governing = (fallback) => record.kind === "change" && record.change !== void 0 ? governingChangePolicy(config, record.change) : fallback;
+	const standingEpoch = standingEpochOf(config);
 	if (record.ownerScope !== "owner") return {
 		owner: "none",
-		changePolicy: governing(defaultChangePolicy(config))
+		changePolicy: governing(defaultChangePolicy(config)),
+		standingEpoch
 	};
 	const entry = ownerEntry(config, record.inboxId);
-	if (entry === void 0) return { owner: "removed" };
+	if (entry === void 0) return {
+		owner: "removed",
+		standingEpoch
+	};
 	return {
 		owner: "present",
 		sendPolicy: entry.sendPolicy ?? config.defaults.sendPolicy,
 		changePolicy: governing(entry.changePolicy ?? defaultChangePolicy(config)),
-		sendEpoch: sendEpochOf(config, record.inboxId)
+		sendEpoch: sendEpochOf(config, record.inboxId),
+		standingEpoch
 	};
 }
 /** The reason a record whose owner was removed is revoked with. */
 const OWNER_REMOVED_REASON = "its mailbox or account was removed";
 /** The reason a send prepared before a `never` is revoked with: its stored epoch is behind the live one. */
 const SEND_EPOCH_REASON = "sending was turned off since this was prepared (policy: never)";
+/**
+* The reason a standing approval, or one of its unused children, is revoked with once standing approvals were ended
+* since it was made: its standing epoch is behind the live one (design 2026-10-19-standing-approvals, S8).
+*/
+const STANDING_EPOCH_REASON = "standing approvals were ended since this was approved";
+/**
+* The reason a standing approval is revoked with once its account's change policy is stricter than the one it was
+* approved under (`approvedChangePolicy`) — `changePolicy-tightened`, read from the configuration itself, whatever the
+* standing epoch says, so a release that knows no epoch tightening the policy still ends it (design
+* 2026-10-19-standing-approvals, S8, the lead's call after review).
+*/
+const CHANGE_POLICY_TIGHTENED_REASON = "the change policy was tightened since this was approved";
+/** Whether `live` is stricter than `approved`: `confirm` over `chat`. */
+function changePolicyTightened(approved, live) {
+	return live === "confirm" && approved !== "confirm";
+}
+/**
+* Whether even a look writes this outcome's revocation down: a standing approval ended by a tightened change policy.
+* Every other revocation a look derives is from something that never goes back — an epoch, an owner's id — so the next
+* action can write it; a policy can be loosened again, and what it ended must stay ended (S8).
+*/
+function writtenAtALook(outcome) {
+	return outcome.revokes && outcome.record?.kind === "standing" && outcome.reason === "the change policy was tightened since this was approved";
+}
 /** What an outcome says of a pending or approved send under a live `never`, before anything revokes it. */
 const NEVER_NOTICE = "sending is turned off (policy: never); any use revokes it";
 /** The refusal of a claim, an approval or an answer by a store opened without a configuration. */
@@ -8742,7 +8850,11 @@ const NO_CONFIGURATION = "this approval store was opened without a configuration
 const sentAtWords = (usedAt) => `sent at ${usedAt}`;
 /** The refusal prefix and detail key of each kind: a send sends nothing, a change changes nothing, a question saves nothing. */
 function refusalOf(kind) {
-	const [prefix, idKey, hint] = kind === "disclosure" ? [
+	const [prefix, idKey, hint] = kind === "standing" ? [
+		"nothing was sent",
+		"approvalId",
+		"This standing approval cannot be used. Ask the person instead; only they can set up another, at their own terminal."
+	] : kind === "disclosure" ? [
 		"nothing was disclosed",
 		"approvalId",
 		"Prepare a new standing disclosure authorisation and show its exact activation preview to the person."
@@ -8773,7 +8885,7 @@ function refusalOf(kind) {
 * or one a pinned surface may not see — byte for byte the same, with `approval: null`, and nothing of any record in it.
 */
 function approvalNotFound(approvalId, kind) {
-	return new CommsError("NOT_FOUND", `${kind === "disclosure" ? "nothing was disclosed" : kind === "change" ? "nothing was changed" : kind === "download" ? "nothing was saved" : "nothing was sent"}: no approval ${approvalId}`, {
+	return new CommsError("NOT_FOUND", `${kind === "disclosure" ? "nothing was disclosed" : kind === "standing" ? "nothing was sent" : kind === "change" ? "nothing was changed" : kind === "download" ? "nothing was saved" : "nothing was sent"}: no approval ${approvalId}`, {
 		hint: "Check the id: an approval is only found by the surface, the kind and the owner it was prepared for.",
 		details: { approval: null }
 	});
@@ -9030,12 +9142,20 @@ function classifyV2(read, context) {
 	const ownerRemoved = read.ownerScope === "owner" && live?.owner === "removed";
 	const active = read.state === "pending" || read.state === "approved";
 	const acting = action === "approve" || action === "claim";
-	const never = read.kind === "send" && live?.owner === "present" && stricterPolicy(live.sendPolicy ?? "never", read.requiredPolicy) === "never";
+	const sends = read.kind === "send" || read.kind === "standing";
+	const standingBound = read.kind === "standing" || read.kind === "send" && read.route === "standing";
+	const never = sends && live?.owner === "present" && stricterPolicy(live.sendPolicy ?? "never", read.requiredPolicy) === "never";
 	let derived = null;
+	let revokedByNever = false;
 	if (active && ownerRemoved) derived = OWNER_REMOVED_REASON;
 	else if (active && never) {
-		if (acting) derived = live?.sendPolicy === "never" ? `sending is turned off for this ${accountNoun(read.channel)} (policy: never)` : "sending is turned off for this approval (policy: never)";
-	} else if (active && read.kind === "send" && live?.owner === "present" && (read.sendEpoch ?? 0) !== live.sendEpoch) derived = SEND_EPOCH_REASON;
+		if (acting) {
+			derived = live?.sendPolicy === "never" ? `sending is turned off for this ${accountNoun(read.channel)} (policy: never)` : "sending is turned off for this approval (policy: never)";
+			revokedByNever = true;
+		}
+	} else if (active && sends && live?.owner === "present" && (read.sendEpoch ?? 0) !== live.sendEpoch) derived = SEND_EPOCH_REASON;
+	else if (active && standingBound && live !== null && live.standingEpoch !== void 0 && read.standingEpoch !== live.standingEpoch) derived = STANDING_EPOCH_REASON;
+	else if (read.kind === "standing" && read.state === "approved" && live?.owner === "present" && changePolicyTightened(read.approvedChangePolicy, live.changePolicy)) derived = CHANGE_POLICY_TIGHTENED_REASON;
 	const record = derived === null ? read : {
 		...read,
 		state: "revoked",
@@ -9043,7 +9163,6 @@ function classifyV2(read, context) {
 		revokedAt: at,
 		challengeHash: void 0
 	};
-	const revokedByNever = derived !== null && derived !== "its mailbox or account was removed" && derived !== "sending was turned off since this was prepared (policy: never)";
 	let claimable = false;
 	let reason = record.reason;
 	if (record.state === "pending" || record.state === "approved") {
@@ -9109,6 +9228,7 @@ function isClaimable(record, live) {
 		case "change": return record.state === "approved" || record.route === "chat" && live.changePolicy === "chat";
 		case "download": return downloadClaimable(record, live.changePolicy);
 		case "disclosure": return record.state === "approved";
+		case "standing": return false;
 	}
 }
 /**
@@ -9157,7 +9277,7 @@ function errorOf(record, approval, context) {
 			if (download) return refuse("APPROVAL_EXPIRED", downloadExpiredWords(record.approvedVia !== void 0), record, approval);
 			const nothing = `nothing was ${record.kind === "change" ? "changed" : "sent"} with it`;
 			return new CommsError("APPROVAL_EXPIRED", record.reason === "clock-anomaly" ? `the clock moved backwards; this approval was expired safely at ${record.expiredAt}; ${nothing}` : record.approvedAt !== void 0 ? `this approval expired; ${nothing}: approved at ${record.approvedAt}, expired unused at ${record.expiredAt}` : `this approval expired; ${nothing}: prepared at ${record.createdAt}, expired at ${record.expiredAt}`, {
-				hint: record.kind === "change" ? "Prepare the change again and show the new preview to the user." : "Prepare the send again and show the new preview to the user.",
+				hint: record.kind === "change" ? "Prepare the change again and show the new preview to the user." : record.kind === "standing" ? "This standing approval has ended. Ask the person instead; only they can set up another, at their own terminal." : "Prepare the send again and show the new preview to the user.",
 				details: {
 					approvalId: record.approvalId,
 					state: record.state,
@@ -9241,6 +9361,578 @@ var AuditLog = class {
 	}
 };
 /**
+* The emoji a standing approval may react with (design 2026-10-19-standing-approvals, S3 and §8.4): a curated list of
+* standard Unicode names, each with its code point, shipped in the code.
+*
+* Only standard names, because a custom workspace emoji's image can be replaced under the same name: the person would
+* have approved a picture that is no longer the one sent. And a short list rather than every Unicode name, because each
+* one here is a word the agent may say on the person's behalf without asking.
+*/
+const STANDARD_EMOJI = Object.freeze({
+	eyes: "U+1F440",
+	white_check_mark: "U+2705",
+	heavy_check_mark: "U+2714",
+	ballot_box_with_check: "U+2611",
+	"+1": "U+1F44D",
+	thumbsup: "U+1F44D",
+	ok: "U+1F197",
+	ok_hand: "U+1F44C",
+	"100": "U+1F4AF",
+	heavy_plus_sign: "U+2795",
+	handshake: "U+1F91D",
+	raised_hands: "U+1F64C",
+	pray: "U+1F64F",
+	clap: "U+1F44F",
+	wave: "U+1F44B",
+	memo: "U+1F4DD",
+	pencil2: "U+270F",
+	hourglass_flowing_sand: "U+23F3",
+	stopwatch: "U+23F1",
+	inbox_tray: "U+1F4E5",
+	pushpin: "U+1F4CC",
+	mag: "U+1F50D",
+	bulb: "U+1F4A1",
+	speech_balloon: "U+1F4AC",
+	thinking_face: "U+1F914",
+	slightly_smiling_face: "U+1F642",
+	heart: "U+2764",
+	tada: "U+1F389",
+	rocket: "U+1F680",
+	sparkles: "U+2728"
+});
+/**
+* The emoji among them that people read as a yes: ✅ on "can I deploy?" is taken for approval, and a Slack workflow
+* can start on a reaction (S3). Allowed, with a warning in the preview.
+*/
+const READS_AS_APPROVAL = Object.freeze([
+	"white_check_mark",
+	"heavy_check_mark",
+	"ballot_box_with_check",
+	"+1",
+	"thumbsup",
+	"ok",
+	"ok_hand",
+	"100",
+	"heavy_plus_sign",
+	"handshake"
+]);
+/** Whether `name` is one of the standard emoji a standing approval may hold, exactly as listed. */
+function isStandardEmoji(name) {
+	return Object.hasOwn(STANDARD_EMOJI, name);
+}
+Object.freeze(["reaction", "reply"]);
+/** S3: what a standing approval holds when no content is given. */
+const STANDING_DEFAULT_REACTION = "eyes";
+/** One day, the unit a standing approval's expiry is counted in. */
+const STANDING_DAY_MS = 864e5;
+/** S6's table: each limit's default and the range a person may set it to. */
+const STANDING_LIMITS = Object.freeze({
+	perThread: Object.freeze({
+		default: 1,
+		min: 1,
+		max: 3
+	}),
+	perHour: Object.freeze({
+		default: 10,
+		min: 1,
+		max: 30
+	}),
+	perDay: Object.freeze({
+		default: 30,
+		min: 1,
+		max: 100
+	}),
+	perSender: Object.freeze({
+		default: 3,
+		min: 1,
+		max: 10
+	}),
+	expiresDays: Object.freeze({
+		default: 7,
+		min: 1,
+		max: 30
+	})
+});
+const LIMIT_NAMES$1 = [
+	"perThread",
+	"perHour",
+	"perDay",
+	"perSender",
+	"expiresDays"
+];
+const CONTENT_WORDS = Object.freeze({
+	"too-many-reactions": `a standing approval holds at most 5 reactions`,
+	"too-many-replies": `a standing approval holds at most 5 replies`,
+	"custom-emoji": "only a standard emoji from the list this release ships may be a standing reaction",
+	empty: "a standing reply has no words",
+	"too-long": `a standing reply is at most 200 characters`,
+	"multi-line": "a standing reply is one line",
+	"control-character": "a standing reply holds a control or invisible character",
+	mention: "a standing reply mentions nobody: no @, and no <@…> or <!…>",
+	link: "a standing reply holds no link, address or domain",
+	placeholder: "a standing reply is sent exactly as written: it holds no placeholder",
+	markup: "a standing reply is plain text: no formatting characters",
+	"emoji-code": "a standing reply holds no :emoji: code; a reaction is its own content",
+	pictograph: "a standing reply holds no emoji or pictograph, such as ✅, ✔ or 👍; a reaction is its own content",
+	duplicate: "a standing approval holds each content once"
+});
+/** The refusal of a content, as BAD_DATA, with its reason and which content it was. */
+function contentRefused(reason, where) {
+	return new CommsError("BAD_DATA", `nothing was prepared: ${CONTENT_WORDS[reason]}`, {
+		hint: reason === "custom-emoji" ? `Choose from the standard emoji: ${Object.keys(STANDARD_EMOJI).join(", ")}.` : "Write each reply as plain words on one line, at most 200 characters: no links, mentions, markup, placeholders, emoji or emoji codes. A reply is sent exactly as written.",
+		details: {
+			reason,
+			...where === void 0 ? {} : {
+				kind: where.kind,
+				position: where.position
+			}
+		}
+	});
+}
+/** The digest of one content: its kind and exact text. */
+function standingContentDigest(kind, text) {
+	return sha256Hex(canonicalJson$1({
+		kind,
+		text
+	}));
+}
+/** A reaction's name, exactly as listed — `:name:` read as `name` — or the refusal of a custom one. */
+function reactionName(written, position) {
+	const trimmed = written.trim();
+	const name = /^:[^:]+:$/.test(trimmed) ? trimmed.slice(1, -1) : trimmed;
+	if (!isStandardEmoji(name)) throw contentRefused("custom-emoji", {
+		kind: "reaction",
+		position
+	});
+	return name;
+}
+/** Each reason a reply's text is refused for, in the order checked: the first that applies is the one given. */
+const REPLY_RULES = Object.freeze([
+	["multi-line", (text) => /[\r\n\u2028\u2029]/.test(text)],
+	["pictograph", (text) => /[\p{Extended_Pictographic}\u2713]/u.test(text)],
+	["control-character", (text) => [...text].some((char) => char === "	" || isDangerous(char.codePointAt(0) ?? 0))],
+	["mention", (text) => /@|<[@!#]/.test(text)],
+	["link", (text) => /:\/\/|www\.|mailto:|[A-Za-z0-9-]+\.[A-Za-z]{2,}/i.test(text)],
+	["placeholder", (text) => /[{}[\]]/.test(text)],
+	["markup", (text) => /[<>*_~`|]/.test(text)],
+	["emoji-code", (text) => /:[A-Za-z0-9_+-]+:/.test(text)]
+]);
+/**
+* Words that read as a yes in a reply (the lead's call, after review): "OK" or "Done" on "can I deploy?" is taken for
+* approval as surely as ✅ is. Matched whole, in any case. Allowed, with a warning in the preview.
+*/
+const APPROVAL_WORDS = Object.freeze([
+	["yes", /\byes\b/i],
+	["approved", /\bapproved\b/i],
+	["approve", /\bapprove\b/i],
+	["go ahead", /\bgo\s+ahead\b/i],
+	["lgtm", /\blgtm\b/i],
+	["ok", /\bok\b/i],
+	["done", /\bdone\b/i],
+	["confirmed", /\bconfirmed\b/i]
+]);
+/** What a reply's reads-as-approval warning begins with: the preview shows it under that reply. */
+function replyWarningPrefix(text) {
+	return `The reply "${text}" can read as approval:`;
+}
+/** S3's warning for a reply holding words that read as a yes, or null. */
+function replyReadsAsApproval(text) {
+	const said = APPROVAL_WORDS.filter(([, pattern]) => pattern.test(text)).map(([word]) => `"${word}"`);
+	if (said.length === 0) return null;
+	return `${replyWarningPrefix(text)} it says ${said.join(", ")}. People read "OK" or "Done" on "can I deploy?" as a yes.`;
+}
+/** A reply's text, trimmed and checked (S3), or the refusal of the first rule it breaks. */
+function replyText(written, position) {
+	const where = {
+		kind: "reply",
+		position
+	};
+	const text = written.trim();
+	if (text === "") throw contentRefused("empty", where);
+	for (const [reason, breaks] of REPLY_RULES) if (breaks(text)) throw contentRefused(reason, where);
+	if ([...text].length > 200) throw contentRefused("too-long", where);
+	return text;
+}
+/** S3's warning for an emoji that reads as approval, in the spec's words. */
+function readsAsApprovalWarning(name) {
+	return `:${name}: can read as approval: people read ✅ on "can I deploy?" as a yes, and a Slack workflow can start on a reaction.`;
+}
+/**
+* The contents a person wrote, checked (S3): reactions first, then replies, each as written, each with its digest; and
+* the warnings the preview shows. With no content given at all, `eyes` alone. Refuses BAD_DATA, with `details.reason`,
+* for anything S3 does not allow.
+*/
+function checkedContents(input) {
+	const reactions = input.reactions ?? [];
+	const replies = input.replies ?? [];
+	if (reactions.length > 5) throw contentRefused("too-many-reactions");
+	if (replies.length > 5) throw contentRefused("too-many-replies");
+	const names = reactions.length === 0 && replies.length === 0 ? [STANDING_DEFAULT_REACTION] : reactions.map((written, index) => reactionName(written, index + 1));
+	const texts = replies.map((written, index) => replyText(written, index + 1));
+	const contents = [...names.map((text) => ({
+		kind: "reaction",
+		text,
+		digest: standingContentDigest("reaction", text)
+	})), ...texts.map((text) => ({
+		kind: "reply",
+		text,
+		digest: standingContentDigest("reply", text)
+	}))];
+	if (new Set(contents.map((content) => content.digest)).size !== contents.length) throw contentRefused("duplicate");
+	return {
+		contents,
+		warnings: [...names.filter((name) => READS_AS_APPROVAL.includes(name)).map(readsAsApprovalWarning), ...texts.map(replyReadsAsApproval).filter((warning) => warning !== null)]
+	};
+}
+/** S6's limits, each from the table: its default when left out, and BAD_DATA outside its range. */
+function checkedLimits(input) {
+	const limits = {};
+	for (const name of LIMIT_NAMES$1) {
+		const { default: fallback, min, max } = STANDING_LIMITS[name];
+		const given = input[name];
+		const value = given ?? fallback;
+		if (!Number.isSafeInteger(value) || value < min || value > max) throw new CommsError("BAD_DATA", `nothing was prepared: ${name} is a whole number from ${min} to ${max}`, {
+			hint: `Leave it out for ${fallback}, or give a whole number from ${min} to ${max}.`,
+			details: {
+				reason: "limit-out-of-range",
+				limit: name,
+				min,
+				max,
+				given: given ?? null
+			}
+		});
+		limits[name] = value;
+	}
+	return limits;
+}
+/** The canonical form of a place, as the digest binds it. */
+function canonicalPlaces(places) {
+	if (places.kind === "threads-i-am-in") return { kind: "threads-i-am-in" };
+	return {
+		kind: "exact",
+		places: places.places.map((place) => ({
+			id: place.id,
+			name: place.name,
+			members: place.members,
+			shared: {
+				extShared: place.shared.extShared,
+				pendingExtShared: place.shared.pendingExtShared,
+				externalMembers: place.shared.externalMembers
+			}
+		}))
+	};
+}
+/**
+* The digest a standing record is bound to: everything its binding holds but the summary — the account, every content
+* with its digest in order, every place as recorded, the limits, who proposed it, what it replaces, and the warnings
+* the person was shown.
+*/
+function standingDigest(binding) {
+	return sha256Hex(canonicalJson$1({
+		kind: "standing",
+		target: {
+			kind: binding.target.kind,
+			name: binding.target.name,
+			id: binding.target.id
+		},
+		contents: binding.contents.map((content) => ({
+			kind: content.kind,
+			text: content.text,
+			digest: content.digest
+		})),
+		places: canonicalPlaces(binding.places),
+		limits: {
+			perThread: binding.limits.perThread,
+			perHour: binding.limits.perHour,
+			perDay: binding.limits.perDay,
+			perSender: binding.limits.perSender,
+			expiresDays: binding.limits.expiresDays
+		},
+		proposedBy: binding.proposedBy,
+		replaces: binding.replaces ?? null,
+		warnings: [...binding.warnings]
+	}));
+}
+/** A narrowing that is not one: USAGE, saying what to do instead. */
+function notANarrowing(message) {
+	return new CommsError("USAGE", `nothing was narrowed: ${message}`, { hint: "A narrowing keeps some of what the standing approval holds. To end it altogether, revoke it." });
+}
+/**
+* The standing approval as it applies after `narrowed`: only the contents whose digests it keeps, only the exact
+* places it keeps, and the lower of each limit — so a narrowing never raises one, whatever it says. USAGE for a digest
+* or a place the approval does not hold, for keeping none, and for places kept from `threads-i-am-in`, which names none.
+*/
+function effectiveStanding(binding, narrowed) {
+	if (narrowed === void 0) return binding;
+	let contents = binding.contents;
+	if (narrowed.keep !== void 0) {
+		const keep = new Set(narrowed.keep);
+		for (const digest of keep) if (!binding.contents.some((content) => content.digest === digest)) throw notANarrowing("it keeps a content this standing approval does not hold");
+		contents = binding.contents.filter((content) => keep.has(content.digest));
+		if (contents.length === 0) throw notANarrowing("it would keep no content at all");
+	}
+	let places = binding.places;
+	if (narrowed.places !== void 0) {
+		if (binding.places.kind !== "exact") throw notANarrowing("threads-i-am-in names no places to keep; narrow its contents or limits, or revoke it");
+		const keep = new Set(narrowed.places);
+		const held = binding.places.places;
+		for (const id of keep) if (!held.some((place) => place.id === id)) throw notANarrowing("it keeps a place this standing approval does not cover");
+		const kept = held.filter((place) => keep.has(place.id));
+		if (kept.length === 0) throw notANarrowing("it would keep no place at all");
+		places = {
+			kind: "exact",
+			places: kept
+		};
+	}
+	const limits = { ...binding.limits };
+	for (const name of LIMIT_NAMES$1) {
+		const lower = narrowed.limits?.[name];
+		if (lower !== void 0 && Number.isFinite(lower)) limits[name] = Math.min(limits[name], lower);
+	}
+	return {
+		...binding,
+		contents,
+		places,
+		limits
+	};
+}
+/**
+* The narrowing `narrowing` makes of what is in force — `binding` as `narrowed` already leaves it — as the `narrowed` to
+* store beside `binding`: the contents and exact places kept, and every limit, as asked. Applies at once, so it may
+* only narrow (S8): USAGE for anything that would widen what is in force — a higher limit, a later expiry, a content
+* or a place not held — and BAD_DATA for a limit outside the table.
+*/
+function narrowedFurther(binding, narrowed, narrowing) {
+	const before = effectiveStanding(binding, narrowed);
+	const kept = effectiveStanding(before, {
+		...narrowing.keep === void 0 ? {} : { keep: narrowing.keep },
+		...narrowing.places === void 0 ? {} : { places: narrowing.places }
+	});
+	const asked = { ...kept.limits };
+	for (const name of LIMIT_NAMES$1) {
+		const value = narrowing.limits?.[name];
+		if (value !== void 0) asked[name] = value;
+	}
+	const after = {
+		...kept,
+		limits: checkedLimits(asked)
+	};
+	if (classifyStandingChange(before, after) === "widens") throw new CommsError("USAGE", "nothing was narrowed: this would widen the standing approval, not narrow it", {
+		hint: "A narrowing only lowers a limit, ends it sooner, or keeps fewer contents or places. Anything more is a new standing approval, which the person approves at their terminal with its code.",
+		details: { reason: "widens" }
+	});
+	return {
+		keep: after.contents.map((content) => content.digest),
+		...after.places.kind === "exact" ? { places: after.places.places.map((place) => place.id) } : {},
+		limits: { ...after.limits }
+	};
+}
+/** How many days a standing approval lasts once approved, as narrowed: the lower of its own and the narrowing's. */
+function standingDays(binding, narrowed) {
+	const lower = narrowed?.limits?.expiresDays;
+	return typeof lower === "number" && Number.isFinite(lower) ? Math.min(binding.limits.expiresDays, lower) : binding.limits.expiresDays;
+}
+/** A Slack conversation a standing approval may name exactly: a channel, a private channel or group DM, or a DM. */
+const STANDING_PLACE_PATTERN = /^[CGD][A-Z0-9]{2,}$/;
+const isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isStrings$1 = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+/** Why `shared` is not a recorded sharing state, or null. */
+function sharedProblem(shared) {
+	if (!isRecord$3(shared)) return "a place has no sharing state";
+	if (typeof shared.extShared !== "boolean" || typeof shared.pendingExtShared !== "boolean") return "a place has no sharing state";
+	if (shared.externalMembers !== null && typeof shared.externalMembers !== "boolean") return "a place has no sharing state";
+	return null;
+}
+/** Why `places` is not a standing approval's places, or null. */
+function placesProblem(places) {
+	if (!isRecord$3(places)) return "it has no places";
+	if (places.kind === "threads-i-am-in") return Object.keys(places).length === 1 ? null : "its places are not one kind";
+	if (places.kind !== "exact" || !Array.isArray(places.places)) return "it has no places";
+	if (places.places.length === 0) return "it names no place";
+	const seen = /* @__PURE__ */ new Set();
+	for (const place of places.places) {
+		if (!isRecord$3(place) || typeof place.id !== "string" || !STANDING_PLACE_PATTERN.test(place.id)) return "a place is not a Slack channel or DM id";
+		if (seen.has(place.id)) return "a place is named twice";
+		seen.add(place.id);
+		if (place.name !== null && typeof place.name !== "string") return "a place has no name or null";
+		if (!Number.isSafeInteger(place.members) || place.members < 0) return "a place has no member count";
+		const shared = sharedProblem(place.shared);
+		if (shared !== null) return shared;
+	}
+	return null;
+}
+/**
+* Why `binding` is not one a standing record may hold, or null: every content one `checkedContents` gives for its
+* texts, in order, with its digest; exactly the warnings those contents give (S3); every limit inside the table; places
+* of one kind, each a Slack id once, with its member count and sharing; an account by its id; and who proposed it. The store refuses one before writing it, and
+* the validator a record that holds one, so nothing a caller assembles by hand — a custom emoji, a 31-day expiry, a
+* reply with a link — can become a standing approval.
+*/
+function standingBindingProblem(binding) {
+	if (!isRecord$3(binding)) return "it is not a standing approval";
+	if (typeof binding.summary !== "string") return "it has no summary";
+	const target = binding.target;
+	if (!isRecord$3(target) || target.kind !== "account" || typeof target.name !== "string") return "it names no account";
+	if (typeof target.id !== "string" || !ACCOUNT_ID_PATTERN.test(target.id)) return "it names no account by its id";
+	if (!Array.isArray(binding.contents)) return "it has no contents";
+	const written = binding.contents;
+	if (!written.every((content) => isRecord$3(content) && typeof content.text === "string")) return "a content is unreadable";
+	const contents = written;
+	let checked;
+	let warnings;
+	try {
+		({contents: checked, warnings} = checkedContents({
+			reactions: contents.filter((content) => content.kind === "reaction").map((content) => content.text),
+			replies: contents.filter((content) => content.kind === "reply").map((content) => content.text)
+		}));
+	} catch {
+		return "a content is not one a standing approval may hold";
+	}
+	if (contents.length === 0) return "it holds no content";
+	const canonical = (list) => canonicalJson$1(list.map((content) => ({
+		kind: content.kind,
+		text: content.text,
+		digest: content.digest
+	})));
+	if (canonical(checked) !== canonical(contents)) return "its contents are not as checked, in order, with their digests";
+	const places = placesProblem(binding.places);
+	if (places !== null) return places;
+	if (!isRecord$3(binding.limits)) return "it has no limits";
+	try {
+		if (canonicalJson$1(checkedLimits(binding.limits)) !== canonicalJson$1(binding.limits)) return "its limits are not whole and complete";
+	} catch {
+		return "a limit is outside the table";
+	}
+	if (binding.proposedBy !== "agent" && binding.proposedBy !== "person") return "it does not say who proposed it";
+	if (binding.replaces !== void 0 && (typeof binding.replaces !== "string" || !APPROVAL_ID_PATTERN.test(binding.replaces))) return "what it replaces is not an approval id";
+	if (!isStrings$1(binding.warnings)) return "its warnings are unreadable";
+	if (canonicalJson$1(binding.warnings) !== canonicalJson$1(warnings)) return "its warnings are not the ones its contents give";
+	return null;
+}
+/** A copy of `binding` holding exactly its own fields, or BAD_DATA naming why it is not one (`standingBindingProblem`). */
+function canonicalStandingBinding(binding) {
+	const problem = standingBindingProblem(binding);
+	if (problem !== null) throw new CommsError("BAD_DATA", `nothing was prepared: ${problem}`, {
+		hint: "This is a bug — please report it.",
+		details: { reason: "binding-invalid" }
+	});
+	return {
+		summary: binding.summary,
+		target: {
+			kind: "account",
+			name: binding.target.name,
+			id: binding.target.id
+		},
+		contents: binding.contents.map((content) => ({
+			kind: content.kind,
+			text: content.text,
+			digest: content.digest
+		})),
+		places: binding.places.kind === "threads-i-am-in" ? { kind: "threads-i-am-in" } : {
+			kind: "exact",
+			places: binding.places.places.map((place) => ({
+				id: place.id,
+				name: place.name,
+				members: place.members,
+				shared: {
+					extShared: place.shared.extShared,
+					pendingExtShared: place.shared.pendingExtShared,
+					externalMembers: place.shared.externalMembers
+				}
+			}))
+		},
+		limits: { ...binding.limits },
+		proposedBy: binding.proposedBy,
+		...binding.replaces === void 0 ? {} : { replaces: binding.replaces },
+		warnings: [...binding.warnings]
+	};
+}
+/**
+* Why `narrowed`, stored beside `binding`, is not a narrowing of it, or null: each key what a narrowing holds, each
+* content and place one the binding has, and no limit above the binding's or outside the table. Not bound into the
+* record's digest, since it changes after approval; only ever able to narrow, so a hand that edits it can only take away.
+*/
+function standingNarrowingProblem(binding, narrowed) {
+	if (narrowed === void 0) return null;
+	if (!isRecord$3(narrowed)) return "it is not a narrowing";
+	for (const key of Object.keys(narrowed)) if (![
+		"keep",
+		"places",
+		"limits"
+	].includes(key)) return "it is not a narrowing";
+	if (narrowed.keep !== void 0 && !isStrings$1(narrowed.keep)) return "it keeps something that is not a digest";
+	if (narrowed.places !== void 0 && !isStrings$1(narrowed.places)) return "it keeps something that is not a place";
+	if (narrowed.limits !== void 0) {
+		if (!isRecord$3(narrowed.limits)) return "its limits are unreadable";
+		for (const [name, value] of Object.entries(narrowed.limits)) {
+			if (!LIMIT_NAMES$1.includes(name)) return "it narrows a limit there is none of";
+			const limit = name;
+			if (!Number.isSafeInteger(value) || value < STANDING_LIMITS[limit].min) return "a limit is outside the table";
+			if (value > binding.limits[limit]) return "it raises a limit";
+		}
+	}
+	try {
+		effectiveStanding(binding, narrowed);
+	} catch {
+		return "it keeps what the standing approval does not hold";
+	}
+	return null;
+}
+/** Whether a place recorded as `after` is one `before` approved: the same id, shared the same, and no bigger a room. */
+function placeCovered(before, after) {
+	const held = before.find((place) => place.id === after.id);
+	if (held === void 0) return false;
+	if (canonicalJson$1(held.shared) !== canonicalJson$1(after.shared)) return false;
+	return after.members < 50 || held.members >= 50;
+}
+/**
+* What `after` does to `before` (S8): `widens` with any content digest or exact place `before` does not hold — a place
+* shared differently, or grown to 50 or more members, is not the place it approved — a swap between exact places and
+* `threads-i-am-in` either way, another account, any higher limit, or a later expiry; `same` when it permits exactly
+* what `before` does; anything else that differs `narrows`. Unclear is a widening: it costs a person a code, never a
+* yes they did not give.
+*/
+function classifyStandingChange(before, after) {
+	if (before.target.id !== after.target.id) return "widens";
+	const held = new Set(before.contents.map((content) => content.digest));
+	if (after.contents.some((content) => !held.has(content.digest))) return "widens";
+	if (before.places.kind !== after.places.kind) return "widens";
+	if (before.places.kind === "exact" && after.places.kind === "exact") {
+		const approved = before.places.places;
+		if (after.places.places.some((place) => !placeCovered(approved, place))) return "widens";
+	}
+	for (const name of LIMIT_NAMES$1) if (after.limits[name] > before.limits[name]) return "widens";
+	const kept = new Set(after.contents.map((content) => content.digest));
+	const fewerContents = before.contents.some((content) => !kept.has(content.digest));
+	const afterPlaces = after.places.kind === "exact" ? after.places.places : [];
+	const fewerPlaces = before.places.kind === "exact" && before.places.places.some((place) => !afterPlaces.some((now) => now.id === place.id));
+	const lower = LIMIT_NAMES$1.some((name) => after.limits[name] < before.limits[name]);
+	return fewerContents || fewerPlaces || lower ? "narrows" : "same";
+}
+Object.freeze({
+	"not-fresh": "the message is older than 15 minutes, or than this standing approval",
+	"not-newest": "the message is not the newest from someone else in its thread or channel",
+	"already-acknowledged": "this message or thread was already acknowledged under a standing approval",
+	"not-human": "the message, or its thread's first message, is not from a person",
+	interactive: "the message has buttons or menus, or came from a workflow",
+	"place-not-covered": "this standing approval does not cover this place",
+	"big-room": "this place has 50 or more members, and was not approved with that count",
+	"count-unreadable": "how many people are in this place could not be read",
+	external: "someone from another organisation is in this place",
+	"shared-state-changed": "who shares this place changed since it was approved",
+	"reaction-as-person": "a standing reaction goes only as the agent app, and here it would go as you",
+	"app-not-member": "the agent app is not a member of this place, or whether it is could not be read",
+	"content-not-held": "this standing approval holds no such content",
+	"clock-behind": "the clock is earlier than this account's last standing act",
+	unreadable: "the message or its thread could not be read"
+});
+Object.freeze({
+	perThread: "per thread",
+	perHour: "an hour",
+	perDay: "a day",
+	perSender: "a day on messages from one person"
+});
+/**
 * The digest a download's question is bound to: the account, the download, the request, the files it listed and the
 * names it showed them under.
 *
@@ -9387,6 +10079,19 @@ function refuseDisclosure(code, reason, record, hint) {
 		} : {}
 	});
 }
+/**
+* The same refusal for a standing approval, which sends only through its children: nothing was sent under it. Its hint
+* never names a command that makes or widens one — only the person does that, at their terminal.
+*/
+function refuseStanding(code, reason, record, hint) {
+	return new CommsError(code, `nothing was sent: ${reason}`, {
+		hint: hint ?? "This standing approval cannot be used. Ask the person instead; only they can set up another, at their own terminal.",
+		details: record ? {
+			approvalId: record.approvalId,
+			state: record.state
+		} : {}
+	});
+}
 /** The refusal in the words of the record's own kind. */
 function refusalFor(record) {
 	switch (approvalKind(record)) {
@@ -9394,6 +10099,7 @@ function refusalFor(record) {
 		case "change": return refuseChange;
 		case "download": return refuseDownload;
 		case "disclosure": return refuseDisclosure;
+		case "standing": return refuseStanding;
 	}
 }
 /**
@@ -9444,6 +10150,14 @@ function cancelledClaim(record) {
 				reason: "cancelled"
 			}
 		});
+		case "standing": return new CommsError("USAGE", "cancelled: nothing was sent", {
+			hint: "The standing approval was not used: it is as it was.",
+			details: {
+				approvalId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
 	}
 }
 /** The refusal of a renewal or an outcome from a call that does not hold the send's claim. It names no token. */
@@ -9563,7 +10277,11 @@ var ApprovalStore = class {
 				reason: CLOCK_ANOMALY,
 				expiredAt: observed.toISOString()
 			};
-			const deadline = record.state === "approved" && record.kind !== "download" && record.usableUntil !== void 0 ? record.usableUntil : record.expiresAt;
+			let deadline = record.state === "approved" && record.kind !== "download" && record.usableUntil !== void 0 ? record.usableUntil : record.expiresAt;
+			if (record.kind === "standing" && record.state === "approved" && record.approvedAt !== void 0 && record.standing) {
+				const narrowed = Date.parse(record.approvedAt) + standingDays(record.standing, record.narrowed) * STANDING_DAY_MS;
+				if (narrowed < Date.parse(deadline)) deadline = new Date(narrowed).toISOString();
+			}
 			if (now >= Date.parse(deadline)) return {
 				...record,
 				state: "expired",
@@ -9731,6 +10449,7 @@ var ApprovalStore = class {
 			const objectOf = (record) => approvalObjectOf(record, live, this.#now());
 			let next;
 			try {
+				await options.before?.(current, outcome);
 				next = decide(current, outcome, live);
 			} catch (error) {
 				throw withApproval(error, objectOf(current));
@@ -9771,7 +10490,7 @@ var ApprovalStore = class {
 				usedSaid: options.usedSaid
 			});
 			if (found.form === "v2" && derived.form === "v2") {
-				const current = outcome.revokes && action !== "inspect" && action !== "wait" && outcome.record !== null && outcome.record !== null ? outcome.record : derived.record;
+				const current = outcome.revokes && outcome.record !== null && (action !== "inspect" && action !== "wait" || writtenAtALook(outcome)) && outcome.record !== null ? outcome.record : derived.record;
 				if (current.state !== found.record.state) await this.#write({
 					...current,
 					updatedAt: this.#now().toISOString()
@@ -9855,6 +10574,10 @@ var ApprovalStore = class {
 				hint: "Nothing more is needed from the person: complete the same activation with the same approval.",
 				details: detail
 			});
+			case "standing": return new CommsError("USAGE", "nothing was sent: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: the standing approval is in force until it ends.",
+				details: detail
+			});
 		}
 	}
 	/** Issues a new challenge to show a human; only its hash is kept. */
@@ -10015,7 +10738,7 @@ var ApprovalStore = class {
 	async approve(approvalId, via, live, answer, kind = "send", _platform = process.platform, options = {}) {
 		if (kind === "disclosure") throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: a standing disclosure approval is only accepted on the trusted terminal or app route");
 		let failure = null;
-		const done = await this.#transition(approvalId, { kind }, "approve", (current, outcome) => {
+		const done = await this.#transition(approvalId, { kind }, "approve", (current, outcome, gate) => {
 			if (outcome.error) throw outcome.error;
 			if (current.state !== "pending") throw this.#alreadyApproved(current, outcome);
 			if (!current.challengeHash) throw refusalFor(current)("APPROVAL_REQUIRED", "no challenge was issued for this approval", current);
@@ -10032,10 +10755,22 @@ var ApprovalStore = class {
 					revokedAt: at.toISOString()
 				};
 			}
+			if (kind === "standing" && via !== "terminal") {
+				failure = {
+					code: "APPROVAL_VOID",
+					reason: "a standing approval is approved only with its code at a terminal, and this was not approved at a terminal"
+				};
+				return {
+					...current,
+					state: "revoked",
+					reason: failure.reason,
+					revokedAt: at.toISOString()
+				};
+			}
 			if (live.draftMessageId !== current.draftMessageId || live.contentDigest !== current.contentDigest) {
 				failure = {
 					code: "APPROVAL_VOID",
-					reason: kind === "change" ? "the change shown is not the one the approval was prepared for" : "the draft changed after the preview was prepared"
+					reason: kind === "change" ? "the change shown is not the one the approval was prepared for" : kind === "standing" ? "the standing approval shown is not the one that was prepared" : "the draft changed after the preview was prepared"
 				};
 				return {
 					...current,
@@ -10075,7 +10810,8 @@ var ApprovalStore = class {
 				approvedAt: at.toISOString(),
 				usableUntil: new Date(at.getTime() + (current.approvedMs ?? APPROVAL_LIFETIMES.approved)).toISOString(),
 				approvedBindingDigest: current.bindingDigest,
-				challengeHash: void 0
+				challengeHash: void 0,
+				...kind === "standing" ? { approvedChangePolicy: gate?.changePolicy ?? "chat" } : {}
 			};
 		}, { usedSaid: options.usedSaid });
 		const failed = failure;
@@ -10094,6 +10830,7 @@ var ApprovalStore = class {
 	*/
 	async claimForSend(approvalId, live, options = {}) {
 		let failure = null;
+		let parentProblem = null;
 		const done = await this.#transition(approvalId, {
 			kind: "send",
 			owner: live.inboxId
@@ -10114,6 +10851,7 @@ var ApprovalStore = class {
 					challengeHash: void 0
 				};
 			};
+			if (parentProblem !== null) return voidWith("APPROVAL_VOID", parentProblem);
 			if (current.inboxSub && current.inboxSub !== live.inboxSub) return voidWith("APPROVAL_VOID", live.inboxSub ? "the inbox is now connected to a different account" : "the account this was prepared for could not be confirmed");
 			if (live.draftMessageId !== current.draftMessageId) return voidWith("APPROVAL_VOID", "the draft was edited after the preview");
 			if (live.contentDigest !== current.contentDigest) return voidWith("APPROVAL_VOID", "the draft content changed after the preview");
@@ -10125,7 +10863,12 @@ var ApprovalStore = class {
 				state: "sending",
 				sendingAt: at
 			};
-		}, { usedSaid: options.usedSaid });
+		}, {
+			usedSaid: options.usedSaid,
+			before: async (current, outcome) => {
+				if (outcome.error === void 0 && current.route === "standing" && current.state === "approved") parentProblem = await this.#standingParentProblem(current);
+			}
+		});
 		const failed = failure;
 		if (failed) throw refusedAfter(refuse$1(failed.code, failed.reason, done.record), done);
 		const claimToken = randomBytes(16).toString("hex");
@@ -10138,6 +10881,31 @@ var ApprovalStore = class {
 		};
 	}
 	/**
+	* Why a standing child may not be claimed now, or null (design 2026-10-19-standing-approvals, S9, the lead's call after
+	* review): its standing approval read again, under that one's own lock — ended by any of the store's rules, an epoch
+	* or a tightened change policy among them, or narrowed so that it no longer holds the child's content or covers its
+	* place. Called with the child's lock held: no lock is ever taken the other way round.
+	*/
+	async #standingParentProblem(child) {
+		const use = child.standingUse;
+		if (child.standingId === void 0 || use === void 0) return "it names no standing approval it is a use of";
+		let seen;
+		try {
+			seen = await this.inspect(child.standingId, {
+				kind: "standing",
+				owner: child.inboxId
+			}, { action: "claim" });
+		} catch {
+			return "its standing approval could not be read";
+		}
+		const parent = seen.outcome.record;
+		if (seen.outcome.error !== void 0 || parent === null || parent.state !== "approved" || parent.standing === void 0) return `its standing approval has ended${seen.outcome.reason === void 0 ? "" : ` (${seen.outcome.reason})`}`;
+		const inForce = effectiveStanding(parent.standing, parent.narrowed);
+		if (!inForce.contents.some((content) => content.digest === use.content)) return "its standing approval no longer holds what it sends";
+		if (inForce.places.kind === "exact" && !inForce.places.places.some((place) => place.id === use.channel)) return "its standing approval no longer covers where it goes";
+		return null;
+	}
+	/**
 	* The file system's O_EXCL is the single-use guarantee, independent of the lock. A send's marker also holds its
 	* claim token, the one thing that lets the claimant — and nobody else — renew its lease and record its outcome.
 	*/
@@ -10299,6 +11067,208 @@ var ApprovalStore = class {
 		return done.record;
 	}
 	/**
+	* A standing approval (design 2026-10-19-standing-approvals, S8), pending, bound to `standingDigest` of its binding —
+	* computed here, never taken from the caller — and to the send epoch of its account and the standing epoch, both as
+	* read when it is made.
+	*
+	* Its route is `confirm` and its `requiredPolicy` `confirm` whatever the change policy is, because what it permits
+	* happens with nobody asked: it is approved only with the code typed at a terminal (`approve`, `via: 'terminal'`),
+	* never by a yes in the chat, a client's form, or an answer carried in a call. It lasts its days once approved
+	* (`approvedMs`). Nothing ever claims it: each use mints a child (`createStandingChild`).
+	*
+	* The binding is checked before anything is written (`canonicalStandingBinding`): a custom emoji, a reply with a
+	* link, a limit outside the table or a place that is no Slack id is refused, however the caller assembled it.
+	*/
+	async createStanding(input) {
+		const standing = canonicalStandingBinding(input.binding);
+		if (typeof input.inboxSub !== "string" || input.inboxSub === "") throw new CommsError("BAD_DATA", "nothing was prepared: a standing approval is made for a known account user", { hint: "This is a bug — please report it." });
+		requireEpochs(input.sendEpoch, input.standingEpoch);
+		requireKnownChannel("slack");
+		await this.ensurePruned();
+		const now = this.#now();
+		const digest = standingDigest(standing);
+		const pendingMs = APPROVAL_LIFETIMES.confirm;
+		const record = this.#bound({
+			approvalId: newApprovalId(),
+			kind: "standing",
+			digestVersion: 2,
+			channel: "slack",
+			ownerScope: "owner",
+			route: "confirm",
+			pendingMs,
+			approvedMs: standing.limits.expiresDays * STANDING_DAY_MS,
+			inboxId: standing.target.id,
+			inboxSub: input.inboxSub,
+			draftId: "standing",
+			draftMessageId: digest,
+			contentDigest: digest,
+			sendEpoch: input.sendEpoch,
+			standingEpoch: input.standingEpoch,
+			policy: "confirm",
+			requiredPolicy: "confirm",
+			riskFlags: [],
+			expect: {
+				to: [],
+				cc: [],
+				bcc: [],
+				subject: standing.summary
+			},
+			challengeAttempts: 0,
+			state: "pending",
+			createdAt: now.toISOString(),
+			expiresAt: new Date(now.getTime() + pendingMs).toISOString(),
+			updatedAt: now.toISOString(),
+			standing
+		});
+		await this.#write(record);
+		return record;
+	}
+	/**
+	* Runs `use` under the standing record's own lock, with the record as it reads there and its classification for a
+	* use (`claim`): its expiry, a revocation the configuration derives — its account removed, `never`, a send epoch or
+	* a standing epoch behind the live one — written before `use` runs, and `outcome.error` set for every state that
+	* refuses a use. `owner` is the account the caller acts for: any other's record is the one `NOT_FOUND`.
+	*
+	* What `use` decides is decided while no revocation, narrowing or approval of this record can land. `use` must not
+	* take this record's lock again: it is held.
+	*/
+	async withStanding(standingId, owner, use) {
+		const path = this.#path(standingId);
+		const expect = {
+			kind: "standing",
+			owner
+		};
+		return withFileLock(`${path}.lock`, async () => {
+			const config = await this.#config();
+			const found = await this.#read(standingId, config);
+			if (found === null || !matchesExpectation(found, expect)) throw approvalNotFound(standingId, "standing");
+			const derived = this.#derived(found);
+			const outcome = approvalOutcome(derived, {
+				action: "claim",
+				live: config === null || derived.form !== "v2" ? null : liveGateOf(config, derived.record),
+				now: this.#now()
+			});
+			if (found.form !== "v2" || derived.form !== "v2" || outcome.record === null) throw outcome.error ?? integrityRefusal(found);
+			const current = outcome.revokes ? outcome.record : derived.record;
+			if (current.state !== found.record.state) await this.#write({
+				...current,
+				updatedAt: this.#now().toISOString()
+			});
+			return use(current, outcome);
+		});
+	}
+	/**
+	* One use of a standing approval (S9): a send record, approved the moment it is made — `route: 'standing'`,
+	* `approvedVia: 'standing'`, `approvedAt` its creation — bound to the standing id, the standing epoch and the send
+	* epoch, and usable once, within `APPROVAL_LIFETIMES.standingChild`. It then takes the one send path every send
+	* takes: `claimForSend`, its O_EXCL marker, the fence and the outcome.
+	*
+	* Minted only by the use (`mintStandingUse`), under the account's acknowledgement ledger lock and then the standing
+	* record's, after every check there. Checked again here, read without that lock — which the caller holds: the
+	* standing record must be this account's, approved at a terminal, under the same epochs and the same account user,
+	* and not ended, or nothing is written. A child never names anything but what its use was checked for.
+	*/
+	async createStandingChild(input) {
+		if (!/^[0-9a-f]{64}$/.test(input.contentDigest)) throw new CommsError("UNEXPECTED", "an approval is bound to a SHA-256 of what it permits, and this is not one", { hint: "This is a bug — please report it." });
+		if (standingUseProblem(input.use) !== null) throw new CommsError("UNEXPECTED", "a standing use’s child names where it acts and what it sends, or nothing", { hint: "This is a bug — please report it." });
+		requireEpochs(input.sendEpoch, input.standingEpoch);
+		requireKnownChannel("slack");
+		const config = await this.#config();
+		if (input.approvalId !== void 0) {
+			if (!APPROVAL_ID_PATTERN.test(input.approvalId) || await this.#read(input.approvalId, config) !== null) throw new CommsError("UNEXPECTED", "a standing use’s child is made under a fresh id, and this is not one", { hint: "This is a bug — please report it." });
+		}
+		const found = await this.#read(input.standingId, config);
+		if (found === null || !matchesExpectation(found, {
+			kind: "standing",
+			owner: input.inboxId
+		})) throw approvalNotFound(input.standingId, "standing");
+		if (found.form !== "v2") throw integrityRefusal(found);
+		const parent = this.#derive(found.record);
+		const live = config === null ? null : liveGateOf(config, parent);
+		const outcome = approvalOutcome({
+			form: "v2",
+			record: parent
+		}, {
+			action: "claim",
+			live,
+			now: this.#now()
+		});
+		if (outcome.error) throw outcome.error;
+		const standing = outcome.record ?? parent;
+		if (standing.state === "pending") throw refuseStanding("APPROVAL_PENDING", "the standing approval waits for the person to approve it at a terminal", standing);
+		const unbound = standing.state !== "approved" ? "the standing approval is not in force" : standing.approvedVia !== "terminal" || standing.approvedBindingDigest !== standing.bindingDigest ? "the standing approval was not approved at a terminal" : standing.standingEpoch !== input.standingEpoch || standing.sendEpoch !== input.sendEpoch ? "the use is not bound to the epochs its standing approval was made under" : standing.inboxSub !== input.inboxSub ? "the use is not for the account user its standing approval was made for" : null;
+		if (unbound !== null) throw refuseStanding("APPROVAL_VOID", unbound, standing);
+		const now = this.#now();
+		const at = now.toISOString();
+		const lifetime = APPROVAL_LIFETIMES.standingChild;
+		const until = new Date(now.getTime() + lifetime).toISOString();
+		const sealed = this.#bound({
+			approvalId: input.approvalId ?? newApprovalId(),
+			kind: "send",
+			digestVersion: 2,
+			channel: "slack",
+			ownerScope: "owner",
+			route: "standing",
+			pendingMs: lifetime,
+			approvedMs: lifetime,
+			inboxId: input.inboxId,
+			inboxSub: input.inboxSub,
+			draftId: input.draftId,
+			draftMessageId: input.draftMessageId,
+			contentDigest: input.contentDigest,
+			sendEpoch: input.sendEpoch,
+			standingEpoch: input.standingEpoch,
+			standingId: input.standingId,
+			standingUse: {
+				channel: input.use.channel,
+				thread: input.use.thread,
+				content: input.use.content
+			},
+			policy: live?.sendPolicy === "chat" ? "chat" : "confirm",
+			requiredPolicy: "confirm",
+			riskFlags: [...input.riskFlags],
+			expect: {
+				to: [...input.expect.to],
+				cc: [...input.expect.cc],
+				bcc: [...input.expect.bcc],
+				subject: input.expect.subject
+			},
+			challengeAttempts: 0,
+			state: "approved",
+			createdAt: at,
+			expiresAt: until,
+			updatedAt: at,
+			approvedVia: "standing",
+			approvedAt: at,
+			usableUntil: until
+		});
+		const record = {
+			...sealed,
+			approvedBindingDigest: sealed.bindingDigest
+		};
+		await this.#write(record);
+		return record;
+	}
+	/**
+	* Narrows a standing approval at once (S8): fewer contents or places, a lower limit, an earlier end. Nothing is asked
+	* for, because nothing more is permitted: anything `classifyStandingChange` calls a widening of what is in force is
+	* refused with USAGE, and the record is left as it was. The binding the person approved stays the record's own, and
+	* what is narrowed is kept beside it, where it can only take away.
+	*/
+	async narrowStanding(standingId, owner, narrowing) {
+		return (await this.#transition(standingId, {
+			kind: "standing",
+			owner
+		}, "revoke", (current, outcome) => {
+			if (outcome.error) throw outcome.error;
+			if (current.state !== "pending" && current.state !== "approved" || current.standing === void 0) throw refuseStanding("APPROVAL_VOID", "the standing approval has ended, so there is nothing to narrow", current);
+			return {
+				...current,
+				narrowed: narrowedFurther(current.standing, current.narrowed, narrowing)
+			};
+		})).record;
+	}
+	/**
 	* A download's question, pending, bound to `downloadDigest(input.download)` — computed here, never taken from the
 	* caller, as a change's digest is. It stands in for the draft revision too.
 	*
@@ -10583,13 +11553,28 @@ var ApprovalStore = class {
 					...derived.record,
 					updatedAt: this.#now().toISOString()
 				});
+				const outcome = approvalOutcome(derived, {
+					action: "inspect",
+					live: config === null || derived.form !== "v2" ? null : liveGateOf(config, derived.record),
+					now: this.#now()
+				});
+				if (writtenAtALook(outcome) && outcome.record !== null) {
+					const ended = {
+						...outcome.record,
+						updatedAt: this.#now().toISOString()
+					};
+					await this.#write(ended);
+					return {
+						stored: {
+							form: "v2",
+							record: ended
+						},
+						outcome
+					};
+				}
 				return {
 					stored: derived,
-					outcome: approvalOutcome(derived, {
-						action: "inspect",
-						live: config === null || derived.form !== "v2" ? null : liveGateOf(config, derived.record),
-						now: this.#now()
-					})
+					outcome
 				};
 			});
 			if (seen === null) continue;
@@ -10628,6 +11613,10 @@ var ApprovalStore = class {
 		return found.sort(byCreation);
 	}
 };
+/** Both epochs a standing record or child binds: whole numbers of 0 or more, or a programming error. */
+function requireEpochs(sendEpoch, standingEpoch) {
+	for (const epoch of [sendEpoch, standingEpoch]) if (!Number.isSafeInteger(epoch) || epoch < 0) throw new CommsError("UNEXPECTED", "a standing approval is bound to whole epochs, and this is not one", { hint: "This is a bug — please report it." });
+}
 /** Oldest first; a record that cannot be read has no time to be ordered by, and follows, by id. */
 function byCreation(a, b) {
 	const createdOf = (stored) => stored.form === "v2" ? stored.record.createdAt : stored.form === "legacy" ? stored.view.createdAt : null;
@@ -10665,7 +11654,7 @@ function sameExpectation(a, b) {
 const CLOCK_ANOMALY = "clock-anomaly";
 const HEX64 = /^[0-9a-f]{64}$/;
 /** Exactly what `Date.prototype.toISOString` writes, which is all the store ever writes. */
-const ISO$1 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const ISO$2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 const STATES$1 = [
 	"pending",
 	"approved",
@@ -10676,7 +11665,10 @@ const STATES$1 = [
 	"expired",
 	"revoked"
 ];
-/** The states each kind can reach. A change or a download is claimed straight to `used`: it is never sent. */
+/**
+* The states each kind can reach. A change or a download is claimed straight to `used`: it is never sent. A standing
+* approval is never claimed at all — its children are — so it ends expired or revoked.
+*/
 const STATES_OF = {
 	send: STATES$1,
 	change: [
@@ -10692,8 +11684,24 @@ const STATES_OF = {
 		"used",
 		"expired",
 		"revoked"
+	],
+	standing: [
+		"pending",
+		"approved",
+		"expired",
+		"revoked"
 	]
 };
+/** A standing approval's child, approved when it is made: never pending. */
+const CHILD_STATES = [
+	"approved",
+	"sending",
+	"used",
+	"failed",
+	"unknown",
+	"expired",
+	"revoked"
+];
 /** The send states that went through a claim, and so carry `sendingAt`. */
 const CLAIMED_SEND = [
 	"sending",
@@ -10701,10 +11709,14 @@ const CLAIMED_SEND = [
 	"failed",
 	"unknown"
 ];
+/** Whether a record is one use of a standing approval: a send on the `standing` route. */
+function isChild(raw) {
+	return raw.kind === "send" && raw.route === "standing";
+}
 /** A record's timestamp field: absent, invalid, or the time it names. */
 function timeOf(value) {
 	if (value === void 0) return null;
-	if (typeof value !== "string" || !ISO$1.test(value)) return "invalid";
+	if (typeof value !== "string" || !ISO$2.test(value)) return "invalid";
 	const at = Date.parse(value);
 	return Number.isFinite(at) && new Date(at).toISOString() === value ? at : "invalid";
 }
@@ -10751,7 +11763,7 @@ function checkVerified(record, raw) {
 	if (raw.digestVersion !== 2) return fail("digest-version");
 	const kind = raw.kind;
 	if (kind === "disclosure") return checkDisclosure(record, raw);
-	if (kind !== "send" && kind !== "change" && kind !== "download") return fail("wrong-shape");
+	if (kind !== "send" && kind !== "change" && kind !== "download" && kind !== "standing") return fail("wrong-shape");
 	if (!STATES$1.includes(raw.state)) return fail("state-impossible");
 	const state = raw.state;
 	if (typeof raw.contentDigest !== "string" || !HEX64.test(raw.contentDigest)) return fail("content-digest-malformed");
@@ -10761,10 +11773,16 @@ function checkVerified(record, raw) {
 	if (kind === "download") {
 		if (record.download === void 0 || downloadDigest(record.download) !== record.contentDigest) return fail("content-digest-mismatch");
 	}
+	if (kind === "standing") {
+		if (record.standing === void 0 || standingBindingProblem(record.standing) !== null) return fail("wrong-shape");
+		if (standingDigest(record.standing) !== record.contentDigest) return fail("content-digest-mismatch");
+		if (standingNarrowingProblem(record.standing, raw.narrowed) !== null) return fail("narrowing-invalid");
+	} else if (raw.standing !== void 0 || raw.narrowed !== void 0) return fail("wrong-shape");
 	const identity = checkIdentity(record, raw, kind);
 	if (identity !== null) return identity;
 	if (!STATES_OF[kind].includes(state)) return fail("state-impossible");
-	const lifetime = checkLifetime(raw, kind);
+	if (isChild(raw) && !CHILD_STATES.includes(state)) return fail("state-impossible");
+	const lifetime = checkLifetime(record, raw, kind);
 	if (lifetime !== null) return lifetime;
 	const times = {};
 	for (const field of TIMESTAMPS) {
@@ -10839,9 +11857,19 @@ function checkIdentity(record, raw, kind) {
 		if (scope !== expected) return fail("identity-contradiction");
 		if (raw.inboxId !== (expected === "owner" ? target?.id : "")) return fail("identity-contradiction");
 	}
-	if (kind === "send") {
-		if (typeof raw.sendEpoch !== "number" || !Number.isInteger(raw.sendEpoch) || raw.sendEpoch < 0) return fail("identity-contradiction");
+	const wholeEpoch = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0;
+	if (kind === "send" || kind === "standing") {
+		if (!wholeEpoch(raw.sendEpoch)) return fail("identity-contradiction");
 	} else if (raw.sendEpoch !== void 0) return fail("identity-contradiction");
+	if (kind === "standing" || isChild(raw)) {
+		if (raw.channel !== "slack" || !wholeEpoch(raw.standingEpoch)) return fail("identity-contradiction");
+	} else if (raw.standingEpoch !== void 0) return fail("identity-contradiction");
+	if (isChild(raw)) {
+		if (typeof raw.standingId !== "string" || !APPROVAL_ID_PATTERN.test(raw.standingId)) return fail("identity-contradiction");
+		if (raw.standingId === raw.approvalId) return fail("identity-contradiction");
+		if (standingUseProblem(raw.standingUse) !== null) return fail("identity-contradiction");
+	} else if (raw.standingId !== void 0 || raw.standingUse !== void 0) return fail("identity-contradiction");
+	if (kind === "standing" && record.standing.target.id !== raw.inboxId) return fail("identity-contradiction");
 	if (kind === "download") {
 		const download = record.download;
 		if (download === void 0 || download.target.id !== raw.inboxId) return fail("identity-contradiction");
@@ -10851,13 +11879,31 @@ function checkIdentity(record, raw, kind) {
 	}
 	return null;
 }
-/** The lifetime profile: what the route says, and nothing the record could have chosen for itself. */
-function checkLifetime(raw, kind) {
+/**
+* The lifetime profile: what the route says, and nothing the record could have chosen for itself. A standing approval
+* waits as a `confirm` change does and lasts the whole days its limits name, from 1 to 30; its child lives
+* `standingChild`, pending and approved alike.
+*/
+function checkLifetime(record, raw, kind) {
 	if (kind === "download") {
 		if (raw.pendingMs !== APPROVAL_LIFETIMES.download) return fail("lifetime-mismatch");
 		if (raw.route !== void 0 || raw.approvedMs !== void 0) return fail("lifetime-mismatch");
 		return null;
 	}
+	if (kind === "standing") {
+		const days = record.standing.limits.expiresDays;
+		const { min, max } = STANDING_LIMITS.expiresDays;
+		if (raw.route !== "confirm" || raw.pendingMs !== APPROVAL_LIFETIMES.confirm) return fail("lifetime-mismatch");
+		if (!Number.isSafeInteger(days) || days < min || days > max) return fail("lifetime-mismatch");
+		if (raw.approvedMs !== days * 864e5) return fail("lifetime-mismatch");
+		if (raw.policy !== "confirm" || raw.requiredPolicy !== "confirm") return fail("lifetime-mismatch");
+		return null;
+	}
+	if (isChild(raw)) {
+		const lifetime = APPROVAL_LIFETIMES.standingChild;
+		if (raw.pendingMs !== lifetime || raw.approvedMs !== lifetime) return fail("lifetime-mismatch");
+		return null;
+	}
 	if (raw.route !== "chat" && raw.route !== "confirm") return fail("lifetime-mismatch");
 	if (raw.pendingMs !== pendingMsOf(raw.route)) return fail("lifetime-mismatch");
 	if (raw.approvedMs !== APPROVAL_LIFETIMES.approved) return fail("lifetime-mismatch");
@@ -10907,6 +11953,10 @@ function checkTimestamps(raw, kind, state, times) {
 		if (!(createdAt <= approvedAt && approvedAt < expiresAt)) return fail("timestamp-misordered");
 		if (usableUntil - approvedAt !== raw.approvedMs) return fail("lifetime-mismatch");
 	}
+	if (isChild(raw)) {
+		if (approvedAt === void 0) return fail("timestamp-missing");
+		if (approvedAt !== createdAt) return fail("timestamp-misordered");
+	}
 	const deadline = usableUntil ?? expiresAt;
 	const since = approvedAt ?? createdAt;
 	const { sendingAt, sendingHeartbeatAt, usedAt, sentAt, failedAt, revokedAt, expiredAt } = times;
@@ -10934,7 +11984,9 @@ function checkTimestamps(raw, kind, state, times) {
 */
 function checkEvidence(record, raw, kind, state) {
 	const via = raw.approvedVia;
-	if (via !== void 0 && via !== "terminal" && via !== "elicitation") return fail("evidence-invalid");
+	if (via !== void 0 && via !== "terminal" && via !== "elicitation" && via !== "standing") return fail("evidence-invalid");
+	if (via === "standing" !== (isChild(raw) && via !== void 0)) return fail("evidence-invalid");
+	if (raw.approvedChangePolicy !== void 0 && (kind !== "standing" || raw.approvedAt === void 0)) return fail("evidence-contradictory");
 	if (kind === "download") {
 		const answer = record.download?.answer;
 		const answered = via !== void 0 || raw.approvedDigest !== void 0 || answer !== void 0;
@@ -10952,7 +12004,9 @@ function checkEvidence(record, raw, kind, state) {
 	if (raw.approvedDigest !== void 0) return fail("evidence-contradictory");
 	if (!(raw.approvedAt !== void 0)) return via !== void 0 || raw.approvedBindingDigest !== void 0 ? fail("evidence-contradictory") : null;
 	if (via === void 0 || raw.approvedBindingDigest === void 0) return fail("evidence-missing");
-	if (kind === "change" && via !== "terminal") return fail("evidence-invalid");
+	if (kind === "standing" && raw.approvedChangePolicy !== "chat" && raw.approvedChangePolicy !== "confirm") return fail("evidence-missing");
+	if ((kind === "change" || kind === "standing") && via !== "terminal") return fail("evidence-invalid");
+	if (isChild(raw) && via !== "standing") return fail("evidence-invalid");
 	if (raw.approvedBindingDigest !== record.bindingDigest) return fail("evidence-contradictory");
 	return null;
 }
@@ -10972,9 +12026,11 @@ const KINDS = [
 	"download",
 	"disclosure"
 ];
+/** Version 2 alone has standing approvals (design 2026-10-19-standing-approvals): no earlier release wrote one. */
+const V2_KINDS = [...KINDS, "standing"];
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const isString = (value) => typeof value === "string";
-const isStrings = (value) => Array.isArray(value) && value.every(isString);
+const isString$1 = (value) => typeof value === "string";
+const isStrings = (value) => Array.isArray(value) && value.every(isString$1);
 const optional = (value, check) => value === void 0 || check(value);
 function unreadable(approvalId, reason) {
 	return {
@@ -10987,22 +12043,22 @@ function unreadable(approvalId, reason) {
 	};
 }
 function expectationShaped(value) {
-	return isObject(value) && isStrings(value.to) && isStrings(value.cc) && isStrings(value.bcc) && isString(value.subject);
+	return isObject(value) && isStrings(value.to) && isStrings(value.cc) && isStrings(value.bcc) && isString$1(value.subject);
 }
 /**
 * The types every record shares, version 1 or 2: anything of the wrong type cannot reach the classifier. Values —
 * a timestamp that is a string but not a time, a digest that is a string but not hex — are the validator's.
 */
 function commonShape(raw) {
-	if (!isString(raw.inboxId)) return "missing-ownership";
-	if (!isString(raw.state) || !STATES.includes(raw.state)) return "wrong-shape";
+	if (!isString$1(raw.inboxId)) return "missing-ownership";
+	if (!isString$1(raw.state) || !STATES.includes(raw.state)) return "wrong-shape";
 	for (const field of [
 		"createdAt",
 		"expiresAt",
 		"updatedAt",
 		"draftId",
 		"draftMessageId"
-	]) if (!isString(raw[field])) return "wrong-shape";
+	]) if (!isString$1(raw[field])) return "wrong-shape";
 	if (!expectationShaped(raw.expect)) return "wrong-shape";
 	for (const field of [
 		"inboxSub",
@@ -11013,17 +12069,23 @@ function commonShape(raw) {
 		"reason",
 		"policy",
 		"requiredPolicy"
-	]) if (!optional(raw[field], isString)) return "wrong-shape";
+	]) if (!optional(raw[field], isString$1)) return "wrong-shape";
 	if (!optional(raw.riskFlags, isStrings)) return "wrong-shape";
 	if (!optional(raw.challengeAttempts, (value) => typeof value === "number")) return "wrong-shape";
 	const kind = raw.kind ?? "send";
 	if (kind === "change") {
 		const change = raw.change;
-		if (!isObject(change) || !isString(change.summary) || !(change.target === null || isObject(change.target)) || !Array.isArray(change.loosened) || !isStrings(change.effects)) return "wrong-shape";
+		if (!isObject(change) || !isString$1(change.summary) || !(change.target === null || isObject(change.target)) || !Array.isArray(change.loosened) || !isStrings(change.effects)) return "wrong-shape";
+	}
+	if (kind === "standing") {
+		const standing = raw.standing;
+		if (!isObject(standing) || !isString$1(standing.summary) || !isObject(standing.target) || !isString$1(standing.target.id) || !Array.isArray(standing.contents) || !standing.contents.every((content) => isObject(content) && isString$1(content.kind) && isString$1(content.text) && isString$1(content.digest)) || !isObject(standing.places) || !isString$1(standing.places.kind) || !isObject(standing.limits) || !isString$1(standing.proposedBy) || !optional(standing.replaces, isString$1) || !isStrings(standing.warnings)) return "wrong-shape";
+		const narrowed = raw.narrowed;
+		if (!optional(narrowed, (value) => isObject(value) && optional(value.keep, isStrings) && optional(value.places, isStrings) && optional(value.limits, isObject))) return "wrong-shape";
 	}
 	if (kind === "download") {
 		const download = raw.download;
-		if (!isObject(download) || !isString(download.summary) || !isObject(download.target) || !isString(download.target.id) || !isStrings(download.files) || !isStrings(download.names) || !isObject(download.folders) || !isString(download.folders.downloads) || !isString(download.folders.current) || !optional(download.listing, (listing) => Array.isArray(listing) && listing.every((file) => isObject(file)))) return "wrong-shape";
+		if (!isObject(download) || !isString$1(download.summary) || !isObject(download.target) || !isString$1(download.target.id) || !isStrings(download.files) || !isStrings(download.names) || !isObject(download.folders) || !isString$1(download.folders.downloads) || !isString$1(download.folders.current) || !optional(download.listing, (listing) => Array.isArray(listing) && listing.every((file) => isObject(file)))) return "wrong-shape";
 	}
 	return null;
 }
@@ -11036,7 +12098,7 @@ function disclosureShape(raw) {
 		"expiresAt",
 		"updatedAt",
 		"bindingDigest"
-	]) if (!isString(raw[field])) return "wrong-shape";
+	]) if (!isString$1(raw[field])) return "wrong-shape";
 	for (const field of [
 		"pendingMs",
 		"approvedMs",
@@ -11052,9 +12114,9 @@ function disclosureShape(raw) {
 		"revokedAt",
 		"expiredAt",
 		"reason"
-	]) if (!optional(raw[field], isString)) return "wrong-shape";
+	]) if (!optional(raw[field], isString$1)) return "wrong-shape";
 	const disclosure = raw.disclosure;
-	if (!isObject(disclosure) || !isString(disclosure.digest) || !isString(disclosure.activationIntentId) || !isString(disclosure.activationKind) || !Array.isArray(disclosure.versions) || !disclosure.versions.every((entry) => isObject(entry) && isString(entry.kind) && isString(entry.id) && typeof entry.version === "number")) return "wrong-shape";
+	if (!isObject(disclosure) || !isString$1(disclosure.digest) || !isString$1(disclosure.activationIntentId) || !isString$1(disclosure.activationKind) || !Array.isArray(disclosure.versions) || !disclosure.versions.every((entry) => isObject(entry) && isString$1(entry.kind) && isString$1(entry.id) && typeof entry.version === "number")) return "wrong-shape";
 	for (const field of [
 		"channel",
 		"ownerScope",
@@ -11069,6 +12131,8 @@ function disclosureShape(raw) {
 		"requiredPolicy",
 		"riskFlags",
 		"approvedBindingDigest",
+		"approvedChangePolicy",
+		"standingUse",
 		"sendingAt",
 		"sendingHeartbeatAt",
 		"sentAt",
@@ -11086,16 +12150,20 @@ function v2Shape(raw) {
 		"channel",
 		"ownerScope",
 		"contentDigest"
-	]) if (!optional(raw[field], isString)) return "wrong-shape";
+	]) if (!optional(raw[field], isString$1)) return "wrong-shape";
 	for (const field of [
 		"pendingMs",
 		"approvedMs",
-		"sendEpoch"
+		"sendEpoch",
+		"standingEpoch"
 	]) if (!optional(raw[field], (value) => typeof value === "number")) return "wrong-shape";
+	if (!optional(raw.standingId, isString$1)) return "wrong-shape";
+	if (!optional(raw.standingUse, isObject)) return "wrong-shape";
 	for (const field of [
 		"route",
 		"bindingDigest",
 		"approvedBindingDigest",
+		"approvedChangePolicy",
 		"approvedAt",
 		"usableUntil",
 		"sendingAt",
@@ -11105,7 +12173,7 @@ function v2Shape(raw) {
 		"failedAt",
 		"revokedAt",
 		"expiredAt"
-	]) if (!optional(raw[field], isString)) return "wrong-shape";
+	]) if (!optional(raw[field], isString$1)) return "wrong-shape";
 	return null;
 }
 /**
@@ -11121,7 +12189,7 @@ function decodeStored(fileId, text, config, now) {
 		return unreadable(fileId, trimmed === "" || trimmed.startsWith("{") && !trimmed.endsWith("}") ? "truncated" : "invalid-json");
 	}
 	if (!isObject(raw)) return unreadable(fileId, "wrong-shape");
-	if (!isString(raw.approvalId)) return unreadable(fileId, "wrong-shape");
+	if (!isString$1(raw.approvalId)) return unreadable(fileId, "wrong-shape");
 	if (raw.kind === "disclosure") {
 		if (raw.digestVersion === 1) return unreadable(fileId, "wrong-shape");
 		const shape = disclosureShape(raw);
@@ -11143,8 +12211,8 @@ function decodeStored(fileId, text, config, now) {
 	const shape = commonShape(raw);
 	if (shape !== null) return unreadable(fileId, shape);
 	if (raw.digestVersion === 1) {
-		if (!optional(raw.kind, (kind) => isString(kind) && KINDS.includes(kind))) return unreadable(fileId, "wrong-shape");
-		if (!isString(raw.digest)) return unreadable(fileId, "wrong-shape");
+		if (!optional(raw.kind, (kind) => isString$1(kind) && KINDS.includes(kind))) return unreadable(fileId, "wrong-shape");
+		if (!isString$1(raw.digest)) return unreadable(fileId, "wrong-shape");
 		if (raw.approvalId !== fileId) return unreadable(fileId, "file-name-mismatch");
 		const record = raw;
 		return {
@@ -11153,7 +12221,7 @@ function decodeStored(fileId, text, config, now) {
 			record
 		};
 	}
-	if (!isString(raw.kind) || !KINDS.includes(raw.kind)) return unreadable(fileId, "missing-kind");
+	if (!isString$1(raw.kind) || !V2_KINDS.includes(raw.kind)) return unreadable(fileId, "missing-kind");
 	const v2 = v2Shape(raw);
 	if (v2 !== null) return unreadable(fileId, v2);
 	const record = raw;
@@ -11277,9 +12345,9 @@ const NEVER = Object.freeze({
 	cursor: null
 });
 /** Exactly what `Date.prototype.toISOString` writes. */
-const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const ISO$1 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 function isoTime(value) {
-	if (typeof value !== "string" || !ISO.test(value)) return null;
+	if (typeof value !== "string" || !ISO$1.test(value)) return null;
 	const at = Date.parse(value);
 	return Number.isFinite(at) && new Date(at).toISOString() === value ? at : null;
 }
@@ -11904,7 +12972,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.22.0";
+const VERSION = "0.23.0";
 /**
 * The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
 *
@@ -12079,8 +13147,8 @@ function locateCliCommand(request, runtime = {
 			const theirs = typeof manifest.version === "string" ? manifest.version : "of no version";
 			return fail("version", `${caller.packageName} ${version} finds ${target.packageName} ${theirs}, at ${installed}`);
 		}
-		const callerWorkspace = workspaceOf(callerRoot);
-		const targetWorkspace = workspaceOf(installed);
+		const callerWorkspace = workspaceOf$1(callerRoot);
+		const targetWorkspace = workspaceOf$1(installed);
 		const sameCheckout = callerWorkspace !== null && callerWorkspace === targetWorkspace;
 		const found = {
 			root: installed,
@@ -12490,7 +13558,7 @@ function installedPackage(start, name) {
 * `pnpm-workspace.yaml` above it, and its `packages` globs. A package under the checkout but not one of them — an
 * installed copy in its `node_modules` — is not a workspace package of it.
 */
-function workspaceOf(root) {
+function workspaceOf$1(root) {
 	let dir = dirname(root);
 	for (;;) {
 		const globs = workspaceGlobs(dir);
@@ -12563,7 +13631,7 @@ Object.freeze({
 	packageName: "@agentcomms/core"
 });
 /** A channel of this release, by its word; a programming error for a word that is none. */
-function entryOf(channel) {
+function entryOf$1(channel) {
 	const entry = CHANNEL_SNAPSHOT.find((each) => each.manifest.channel === channel);
 	if (entry === void 0) throw new TypeError(`"${channel}" is not a channel of this release`);
 	return entry;
@@ -12595,8 +13663,8 @@ function cliHandoffs(options) {
 		caller,
 		platform,
 		own: (words, use) => locate(own, words, use),
-		core: (words, use) => locate(entryOf("core"), words, use),
-		of: (channel, words, use) => locate(entryOf(channel), words, use),
+		core: (words, use) => locate(entryOf$1("core"), words, use),
+		of: (channel, words, use) => locate(entryOf$1(channel), words, use),
 		on: (other) => other === platform ? handoffs : cliHandoffs({
 			...options,
 			platform: other
@@ -13490,7 +14558,7 @@ async function gatedChangeAtTerminal(core, change, options) {
 		if ((await approveChangeAtTerminal(core, prepared.approvalId, options.env, options.output, streams)).state !== "approved") throw cancelled();
 	} else if (options.answered !== true) {
 		streams.stdout.write(`${prepared.preview}\n\n`);
-		if ((await askLine(streams, `Type ${paint(options.output.color, "bold", "yes")} to apply this change: `)).trim().toLowerCase() !== "yes") {
+		if ((await askLine$1(streams, `Type ${paint(options.output.color, "bold", "yes")} to apply this change: `)).trim().toLowerCase() !== "yes") {
 			await revokeChange(core, prepared.approvalId, "cancelled at the terminal", {
 				surface: "cli",
 				disposition: "person"
@@ -13555,7 +14623,7 @@ async function approveChangeAtTerminal(core, approvalId, env, output, streams =
 	}
 	const prompt = await beginChangeApproval(core, approvalId, { surface: "cli" });
 	streams.stdout.write(`${prompt.preview}\n\n`);
-	const answer = await askLine(streams, `Type ${paint(output.color, "bold", prompt.challenge)} to approve this change, or press Enter to cancel: `);
+	const answer = await askLine$1(streams, `Type ${paint(output.color, "bold", prompt.challenge)} to approve this change, or press Enter to cancel: `);
 	if (!answer.trim()) {
 		await revokeChange(core, approvalId, "cancelled at the terminal", {
 			surface: "cli",
@@ -13575,7 +14643,7 @@ async function approveChangeAtTerminal(core, approvalId, env, output, streams =
 function cancelled() {
 	return new CommsError("USAGE", "cancelled: nothing was changed");
 }
-async function askLine(streams, question) {
+async function askLine$1(streams, question) {
 	const { createInterface } = await import("node:readline/promises");
 	const rl = createInterface({
 		input: streams.stdin,
@@ -13910,6 +14978,186 @@ async function openSecretStore(kind, options) {
 	if (!keyring) throw new CommsError("SECRET_STORE_UNAVAILABLE", "secrets are kept in the system keychain, but the keychain module is missing", { hint: "Reinstall with optional dependencies, or re-add the inbox with --store file." });
 	return new KeychainSecretStore(keyring, options.namespace, KEYCHAIN_TIMEOUT_MS, told);
 }
+/** Exactly what `Date.prototype.toISOString` writes. */
+const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const OUTCOMES = [
+	"sent",
+	"failed",
+	"unknown"
+];
+const isString = (value) => typeof value === "string";
+const isTime$2 = (value) => isString(value) && ISO.test(value) && !Number.isNaN(Date.parse(value));
+/** One line as an entry, or null when it is not one this release wrote. */
+function entryOf(line) {
+	let raw;
+	try {
+		raw = JSON.parse(line);
+	} catch {
+		return null;
+	}
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+	const entry = raw;
+	if (!isTime$2(entry.at)) return null;
+	if (entry.kind === "use") {
+		if (![
+			"standingId",
+			"childId",
+			"contentDigest",
+			"channel",
+			"ts",
+			"thread",
+			"sender",
+			"targetDigest"
+		].every((field) => isString(entry[field]) && entry[field] !== "")) return null;
+		if (entry.act !== "reaction" && entry.act !== "reply") return null;
+		if (typeof entry.edited !== "boolean") return null;
+		return {
+			kind: "use",
+			at: entry.at,
+			standingId: entry.standingId,
+			childId: entry.childId,
+			act: entry.act,
+			contentDigest: entry.contentDigest,
+			channel: entry.channel,
+			ts: entry.ts,
+			thread: entry.thread,
+			sender: entry.sender,
+			targetDigest: entry.targetDigest,
+			edited: entry.edited
+		};
+	}
+	if (entry.kind === "outcome") {
+		if (!isString(entry.childId) || !isString(entry.outcome) || !OUTCOMES.includes(entry.outcome)) return null;
+		if (!isString(entry.notice) || entry.link !== void 0 && !isString(entry.link)) return null;
+		if (entry.actAt !== void 0 && !isTime$2(entry.actAt)) return null;
+		return {
+			kind: "outcome",
+			at: entry.at,
+			...entry.actAt === void 0 ? {} : { actAt: entry.actAt },
+			childId: entry.childId,
+			outcome: entry.outcome,
+			...entry.link === void 0 ? {} : { link: entry.link },
+			notice: entry.notice
+		};
+	}
+	return null;
+}
+var AckLedger = class {
+	directory;
+	#now;
+	constructor(stateDir, now = () => /* @__PURE__ */ new Date()) {
+		this.directory = join(stateDir, "standing");
+		this.#now = now;
+	}
+	/** The clock this ledger was opened with: what a use is timed by, and its counts' windows measured from. */
+	now() {
+		return this.#now();
+	}
+	/** The account's ledger file. Refuses anything but an account id, so no name can reach another path. */
+	#path(accountId) {
+		if (typeof accountId !== "string" || !ACCOUNT_ID_PATTERN.test(accountId)) throw new CommsError("USAGE", `"${String(accountId)}" is not an account id`, { hint: "A standing approval’s ledger is kept per account, by the account’s id." });
+		return join(this.directory, `${accountId}.jsonl`);
+	}
+	/** Every line, read: the entries, and the number — from 1 — of each line this release cannot read. */
+	async #read(path) {
+		let text = "";
+		try {
+			text = await readFile(path, "utf8");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const entries = [];
+		const unreadable = [];
+		for (const [index, line] of text.split("\n").entries()) {
+			if (line.trim() === "") continue;
+			const entry = entryOf(line);
+			if (entry === null) unreadable.push(index + 1);
+			else entries.push(entry);
+		}
+		return {
+			entries,
+			unreadable
+		};
+	}
+	/** Where an account's ledger is kept: `<state>/standing/<accountId>.jsonl`, for a person told to move it aside. */
+	pathOf(accountId) {
+		return this.#path(accountId);
+	}
+	/**
+	* Every account's ledger on this machine that holds a line this release cannot read, with the number of each such
+	* line, for the doctor (design 2026-10-19-standing-approvals, the lead's call after review): while one does, no
+	* standing approval of that account can be used — what it counts cannot be known — and nothing else says so. Reads
+	* without the lock: a look, and every line it reads was written whole.
+	*/
+	async unreadable() {
+		let names;
+		try {
+			names = await readdir(this.directory);
+		} catch (error) {
+			if (error.code === "ENOENT") return [];
+			throw error;
+		}
+		const found = [];
+		for (const name of names.sort()) {
+			if (!name.endsWith(".jsonl")) continue;
+			const accountId = name.slice(0, -6);
+			if (!ACCOUNT_ID_PATTERN.test(accountId)) continue;
+			const path = this.#path(accountId);
+			const { unreadable } = await this.#read(path);
+			if (unreadable.length > 0) found.push({
+				accountId,
+				path,
+				lines: unreadable
+			});
+		}
+		return found;
+	}
+	/**
+	* Runs `fn` under the account's ledger lock, with every entry as it reads there and `append`, which writes a `use`
+	* line under the lock already held. `fn` must never take this lock again.
+	*
+	* A line this release cannot read refuses the whole call, BAD_DATA, before `fn` runs: a count read without it could
+	* be lower than the truth, and a count is never guessed downwards.
+	*/
+	withLock(accountId, fn) {
+		let path;
+		try {
+			path = this.#path(accountId);
+		} catch (error) {
+			return Promise.reject(error);
+		}
+		return withFileLock(`${path}.lock`, async () => {
+			const { entries, unreadable } = await this.#read(path);
+			if (unreadable.length > 0) throw new CommsError("BAD_DATA", "nothing was sent: this account’s standing acknowledgement ledger has a line that cannot be read", {
+				hint: "No standing approval of this account can be used until the ledger reads whole: what it counts cannot be known. Ask the person instead; the doctor says which line, and how to recover.",
+				details: {
+					unreadable: unreadable.length,
+					lines: unreadable
+				}
+			});
+			const append = async (entry) => {
+				if (entry.kind !== "use" || entryOf(JSON.stringify(entry)) === null) throw new CommsError("UNEXPECTED", "a standing use is written whole, or not at all", { hint: "This is a bug — please report it." });
+				await appendPrivateLine(path, JSON.stringify(entry), { durable: true });
+			};
+			return fn(entries, append);
+		});
+	}
+	/** Records what became of a use's act, taking the lock itself. It never frees a count. */
+	async recordOutcome(accountId, entry) {
+		const path = this.#path(accountId);
+		const written = {
+			...entry,
+			kind: "outcome",
+			at: entry.at ?? this.#now().toISOString()
+		};
+		if (entryOf(JSON.stringify(written)) === null) throw new CommsError("UNEXPECTED", "a standing outcome is written whole, or not at all", { hint: "This is a bug — please report it." });
+		await withFileLock(`${path}.lock`, () => appendPrivateLine(path, JSON.stringify(written), { durable: true }));
+	}
+	/** Every entry this release can read, oldest first, for a report: a line it cannot read is left out of it. */
+	async entries(accountId) {
+		return (await this.#read(this.#path(accountId))).entries;
+	}
+};
 var InboxStateStore = class {
 	directory;
 	constructor(stateDir) {
@@ -14744,6 +15992,7 @@ function openCore(options = {}) {
 			answered: (approvalId) => securityAnswered(paths.stateDir, approvalId)
 		}),
 		ledger: new SendLedger(paths.stateDir, now),
+		acks: new AckLedger(paths.stateDir, now),
 		plans: new PlanStore(paths.stateDir, now),
 		taint: new TaintStore(paths.stateDir, now),
 		audit,
@@ -14811,9 +16060,26 @@ function stillWaiting(stored, outcome) {
 	if (outcome.state === "sending") return true;
 	return outcome.state === "pending" && !outcome.claimable;
 }
+/**
+* A standing approval's own state, as `standing list` reads it: `never` on its account ends it at a look, before any
+* use writes that down. Undefined for every other kind.
+*/
+function standingStateOf(outcome) {
+	if (outcome.record?.kind !== "standing") return void 0;
+	const never = outcome.reason === NEVER_NOTICE;
+	if (outcome.state === "pending" && !never) return { state: "pending" };
+	if (outcome.state === "approved" && !never) return { state: "active" };
+	const reason = outcome.reason ?? outcome.record.reason;
+	return {
+		state: "ended",
+		...reason === void 0 ? {} : { reason }
+	};
+}
 /** Why a wait that has stopped waiting ended, from the classification it stopped on. */
-function endOf(outcome) {
+function endOf$1(outcome) {
 	if (outcome.claimable) return "claimable";
+	const standing = standingStateOf(outcome);
+	if (standing !== void 0) return standing.state === "active" ? "active" : "final";
 	if (outcome.record !== null && outcome.state === "approved") return "blocked";
 	return "final";
 }
@@ -14868,6 +16134,7 @@ async function waitHeld(core, approvalId, waitSeconds, options) {
 			ended,
 			waitedSeconds
 		};
+		const standing = standingStateOf(outcome);
 		return {
 			approvalId,
 			state: outcome.state,
@@ -14875,13 +16142,14 @@ async function waitHeld(core, approvalId, waitSeconds, options) {
 			approval,
 			ended,
 			waitedSeconds,
-			...ended === "timeout" ? { hint: waitAgainHint(outcome.state, options.channel) } : {}
+			...ended === "timeout" ? { hint: waitAgainHint(outcome.state, options.channel) } : {},
+			...standing === void 0 ? {} : { standing }
 		};
 	};
 	if (waitSeconds === 0) return finish("now", seen.outcome);
 	let lastProgress = started;
 	for (;;) {
-		if (!stillWaiting(seen.stored, seen.outcome)) return finish(endOf(seen.outcome), seen.outcome);
+		if (!stillWaiting(seen.stored, seen.outcome)) return finish(endOf$1(seen.outcome), seen.outcome);
 		if (options.signal?.aborted) return cancelled();
 		if (clock.now() >= deadline) return finish("timeout", seen.outcome);
 		const next = lastLook + WAIT_LOOK_MS;
@@ -14909,7 +16177,7 @@ async function waitHeld(core, approvalId, waitSeconds, options) {
 			lastLook = clock.now();
 			seen = await core.approvals.inspect(approvalId, expect, { action: "wait" });
 		}
-		if (!stillWaiting(seen.stored, seen.outcome)) return finish(endOf(seen.outcome), seen.outcome);
+		if (!stillWaiting(seen.stored, seen.outcome)) return finish(endOf$1(seen.outcome), seen.outcome);
 		return finish("cancelled", seen.outcome);
 	}
 }
@@ -15891,7 +17159,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: serverFacts(request.channel).packageName,
-		version: "0.22.0"
+		version: "0.23.0"
 	};
 	const product = {
 		packageName,
@@ -16039,6 +17307,12 @@ function everyServerPruneChange(core, env, request) {
 		}
 	};
 }
+Object.freeze([
+	"narrow",
+	"revoke",
+	"off"
+]);
+Object.keys(STANDING_LIMITS);
 /**
 * Bringing a machine to the latest release, from a terminal (`agentcomms update`) or a chat (`comms_update`).
 *
@@ -17312,7 +18586,7 @@ function terminalUpdateHooks(core, env, options = {}) {
 	} };
 }
 //#endregion
-//#region ../core/dist/tool-arguments-H5H3FITT.mjs
+//#region ../core/dist/tool-arguments-C2vEASTA.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -27628,6 +28902,27 @@ strictObject({
 		if (manifest.skills.contract !== `skills/_shared/contract-${family}.md`) issue(["skills", "contract"], `skills/_shared/contract-${family}.md: a skill's contract is chosen by its prefix`);
 	}
 });
+/** The environment values the Windows script reads the title and the body from. */
+const TITLE_VARIABLE = "AGENTCOMMS_NOTICE_TITLE";
+const BODY_VARIABLE = "AGENTCOMMS_NOTICE_BODY";
+Object.freeze([
+	"-e",
+	"on run argv",
+	"-e",
+	"display notification (item 1 of argv) with title (item 2 of argv)",
+	"-e",
+	"end run"
+]);
+[
+	"$ErrorActionPreference = 'Stop'",
+	"$null = [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime]",
+	"$xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)",
+	"$text = $xml.GetElementsByTagName('text')",
+	`$null = $text.Item(0).AppendChild($xml.CreateTextNode([string]$env:${TITLE_VARIABLE}))`,
+	`$null = $text.Item(1).AppendChild($xml.CreateTextNode([string]$env:${BODY_VARIABLE}))`,
+	"$toast = [Windows.UI.Notifications.ToastNotification]::new($xml)",
+	"[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe').Show($toast)"
+].join("; ");
 /**
 * Email HTML is attacker-controlled. Before any of it becomes text a model reads, this removes what a human reading
 * the message in a mail client would not see — the channel used by hidden-text prompt injection (e.g. zero-size or
@@ -29001,6 +30296,10 @@ async function fenceOrStop(store, approvalId, claimToken, progress) {
 		})
 	};
 }
+Object.freeze({
+	min: 5e3,
+	max: 3e4
+});
 Object.freeze({
 	complete: "not sent with any approval in the last 90 days",
 	window: "not sent with any of the 500 most recently changed approval records",