thumbgate 1.34.0 → 1.34.2

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.34.0",
+  "version": "1.34.2",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.34.0",
+  "version": "1.34.2",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate.ai",
   "transport": "stdio",

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.34.0", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.34.2", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.34.0", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.34.2", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/forge/forge.yaml

@@ -9,12 +9,12 @@ version: "1"
 skills:
   thumbgate-gate-check:
     description: "ThumbGate PreToolUse gate — blocks known-bad tool calls"
-    command: "npx --yes --package thumbgate@1.34.0 thumbgate gate-check"
+    command: "npx --yes --package thumbgate@1.34.2 thumbgate gate-check"
     trigger: pre_tool_use
 
   thumbgate-feedback:
     description: "ThumbGate feedback capture — logs user prompt context"
-    command: "npx --yes --package thumbgate@1.34.0 thumbgate hook-auto-capture"
+    command: "npx --yes --package thumbgate@1.34.2 thumbgate hook-auto-capture"
     trigger: user_prompt
 
 mcp:
@@ -23,6 +23,6 @@ mcp:
     args:
       - "--yes"
       - "--package"
-      - "thumbgate@1.34.0"
+      - "thumbgate@1.34.2"
       - "thumbgate"
       - "serve"

package/adapters/mcp/server-stdio.js

@@ -328,7 +328,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.34.0' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.34.2' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.34.0",
+        "thumbgate@1.34.2",
         "thumbgate",
         "serve"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.34.0",
+  "version": "1.34.2",
   "description": "ThumbGate Pre-Action Checks self-improve from ranked lessons and repeated failures, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -614,7 +614,7 @@
     "test:evolution": "node --test tests/workspace-evolver.test.js",
     "test:watcher": "node --test tests/jsonl-watcher.test.js",
     "test:autoresearch": "node --test tests/autoresearch.test.js",
-    "test:ops": "node --test tests/qa-scenario-planner.test.js tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/financial-control-plane.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js tests/auto-promote-regression-gate.test.js",
+    "test:ops": "node --test tests/qa-scenario-planner.test.js tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/financial-control-plane.test.js tests/financial-spend-attack-matrix.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js tests/auto-promote-regression-gate.test.js",
     "test:session-analyzer": "node --test tests/session-analyzer.test.js",
     "test:tessl": "node --test tests/tessl-export.test.js",
     "test:gates": "node --test --test-concurrency=1 tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/universal-claim-evaluator.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js tests/deny-network-egress-pattern.test.js tests/git-pathspec-scope.test.js tests/git-global-option-bypass.test.js tests/gate-evasion-matrix.test.js",
@@ -996,7 +996,7 @@
     "@google/genai": {
       "protobufjs": "7.6.5"
     },
-    "brace-expansion": "5.0.8",
+    "brace-expansion": "5.0.9",
     "onnxruntime-web": {
       "protobufjs": "7.6.5"
     },

package/public/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="generator" content="ThumbGate">
   <meta name="author" content="Igor Ganapolsky">
-  <meta name="thumbgate-version" content="1.34.0">
+  <meta name="thumbgate-version" content="1.34.2">
   __GOOGLE_SITE_VERIFICATION_META__
   <link rel="icon" type="image/png" href="/thumbgate-icon.png">
   <link rel="canonical" href="__APP_ORIGIN__/">
@@ -942,7 +942,7 @@ next      decision recorded before execution</pre>
 
   <footer>
     <div class="shell footer-inner">
-      <span>ThumbGate · MIT License · npm v1.34.0</span>
+      <span>ThumbGate · MIT License · npm v1.34.2</span>
       <div class="footer-links">
         <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
         <a href="/guide">Technical setup</a>

package/public/numbers.html

@@ -10,12 +10,12 @@
 <meta property="og:title" content="ThumbGate — The Numbers">
 <meta property="og:description" content="Generated first-party operational snapshot: configured gates, recorded interventions, and explicit zero-evidence caveats.">
 <meta property="og:type" content="website">
-<meta property="og:url" content="https://thumbgate.ai/numbers">
+<meta property="og:url" content="https://thumbgate-production.up.railway.app/numbers">
 <meta name="twitter:card" content="summary_large_image">
-<link rel="canonical" href="https://thumbgate.ai/numbers">
+<link rel="canonical" href="https://thumbgate-production.up.railway.app/numbers">
 <link rel="icon" type="image/png" href="/thumbgate-icon.png">
 <link rel="apple-touch-icon" href="/apple-touch-icon.png">
-<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 
 <script type="application/ld+json">
 {
@@ -25,9 +25,9 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.34.0",
-  "url": "https://thumbgate.ai/numbers",
-  "dateModified": "2026-05-07",
+  "softwareVersion": "1.34.2",
+  "url": "https://thumbgate-production.up.railway.app/numbers",
+  "dateModified": "2026-08-03",
   "creator": {
     "@type": "Person",
     "name": "Igor Ganapolsky",
@@ -46,7 +46,7 @@
   "@type": "Dataset",
   "name": "ThumbGate Operational Snapshot",
   "description": "First-party operational snapshot from the ThumbGate pre-action check runtime: configured checks, recorded block/warn events, estimated token savings from recorded blocks, and Bayes error rate when the sample supports it.",
-  "url": "https://thumbgate.ai/numbers",
+  "url": "https://thumbgate-production.up.railway.app/numbers",
   "license": "https://opensource.org/licenses/MIT",
   "creator": {
     "@type": "Person",
@@ -57,8 +57,8 @@
       "https://www.linkedin.com/in/igorganapolsky"
     ]
   },
-  "dateModified": "2026-05-07",
-  "datePublished": "2026-05-07",
+  "dateModified": "2026-08-03",
+  "datePublished": "2026-08-03",
   "keywords": [
     "AI agent gates",
     "LLM token savings",
@@ -70,7 +70,7 @@
     {
       "@type": "PropertyValue",
       "name": "configured_gates",
-      "value": 36
+      "value": 40
     },
     {
       "@type": "PropertyValue",
@@ -195,7 +195,6 @@
   <a href="/learn">Learn</a>
   <a href="/compare">Compare</a>
   <a href="/numbers">Numbers</a>
-  <a href="/evaluations">Evaluations</a>
   <a href="/dashboard">Dashboard</a>
   <a href="/pro">Pro</a>
 </nav>
@@ -203,15 +202,15 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-05-07 · Version 1.34.0</div>
+  <div class="freshness">Updated: 2026-08-03 · Version 1.34.2</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>
   <div class="stats-grid">
     <div class="stat-card">
       <div class="stat-label">Configured checks</div>
-      <div class="stat-value">36</div>
-      <div class="stat-sub">36 shipped defaults · 0 auto-promoted; inventory, not usage</div>
+      <div class="stat-value">40</div>
+      <div class="stat-sub">40 shipped defaults · 0 auto-promoted; inventory, not usage</div>
       <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/gate-stats.js">source: gate-stats.js</a>
     </div>
     <div class="stat-card">
@@ -278,7 +277,7 @@
   <div class="cta">
     <a href="https://www.npmjs.com/package/thumbgate">Install ThumbGate — npx thumbgate init</a>
     <div class="footer-note">Prefer the raw feed? See <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> or run <code>npm run gate:stats</code> locally.</div>
-    <div class="footer-note">Generated at 2026-05-07T14:59:51.816Z UTC.</div>
+    <div class="footer-note">Generated at 2026-08-03T05:26:21.201Z UTC.</div>
   </div>
 </main>
 </body>

package/scripts/financial-control-plane.js

@@ -48,6 +48,10 @@ const ECONOMIC_ACTION_PATTERNS = [
   /\badd\s+(?:a\s+)?(?:credit\s+)?card\b/i,
   /\badd\s+(?:a\s+)?payment\s+method\b/i,
   /\b(?:buy|purchase|subscribe|top-?up)\b/i,
+  /\bcharge\s+(?:me\s+)?(?:\$|usd\s*)\d/i,
+  /\bupgrade\b.{0,40}\b(?:pro|premium|business|enterprise)\b/i,
+  /\b(?:activate|cancel|change|create|update|upgrade)\s+(?:a\s+)?(?:\w+\s+){0,3}(?:plan|subscription|tier|seat)\b/i,
+  /\b(?:activate|cancel|change|create|update|upgrade)\s+(?:a\s+)?(?:\w+\s+){0,3}(?:checkout|payment\s+method)\b/i,
   /\b(?:confirm|complete|open|start)\s+(?:the\s+)?checkout\b/i,
   /\bcheckout\s+(?:flow|page|session)\b/i,
   /\b(?:issue|send)\s+(?:a\s+)?(?:invoice|payout|refund)\b/i,
@@ -58,8 +62,31 @@ const ECONOMIC_ACTION_PATTERNS = [
   /\brenew\s+(?:a\s+)?subscription\b/i,
   /\btransfer\s+(?:dollars?|funds|money|usd)\b/i,
   /\bupgrade\s+(?:a\s+)?plan\b/i,
-  /\b(?:charges?|checkout[\s_-]*sessions?|invoices?|payment[\s_-]*intents?|payment[\s_-]*methods?|payouts?|refunds?|subscriptions?|top[\s_-]*ups?|transfers?)\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
-  /\b(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\s+(?:a\s+)?(?:charge|invoice|payment|payment\s+method|payout|refund|subscription|top-?up|transfer)\b/i,
+  /\bcharges?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\bcheckout[\s_-]*sessions?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\binvoices?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\bpayment[\s_-]*intents?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\bpayment[\s_-]*methods?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\bpayouts?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\brefunds?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\bsubscriptions?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\btop[\s_-]*ups?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\btransfers?\s+(?:attach|cancel|capture|confirm|create|detach|finalize|pay|refund|send|update)\b/i,
+  /\b(?:attach|cancel|capture|confirm|create|detach)\s+(?:a\s+)?(?:charge|invoice|payment|payment\s+method)\b/i,
+  /\b(?:finalize|pay|refund|send|update)\s+(?:a\s+)?(?:charge|invoice|payment|payment\s+method)\b/i,
+  /\b(?:attach|cancel|capture|confirm|create|detach)\s+(?:a\s+)?(?:payout|refund|subscription|top-?up|transfer)\b/i,
+  /\b(?:finalize|pay|refund|send|update)\s+(?:a\s+)?(?:payout|refund|subscription|top-?up|transfer)\b/i,
+];
+
+// Host/path URL surfaces that open paid checkout or plan-upgrade flows.
+// These are NOT covered by prose patterns alone (e.g. `open https://app.apollo.io/#/settings/plans/upgrade`
+// or WebFetch { url: 'https://checkout.stripe.com/...' }) — Apollo $588 incident class.
+const ECONOMIC_URL_PATTERNS = [
+  /(?:https?:\/\/)?(?:www\.)?checkout\.stripe\.com\b/i,
+  /(?:https?:\/\/)?(?:www\.)?buy\.stripe\.com\b/i,
+  /(?:https?:\/\/)?(?:www\.)?billing\.stripe\.com\b/i,
+  /(?:https?:\/\/)?(?:www\.)?app\.apollo\.io\b[^\s"'`]*?(?:plans|upgrade|billing|checkout|subscription)/i,
+  /(?:https?:\/\/)?(?:www\.)?apollo\.io\b[^\s"'`]*?(?:plans|upgrade|billing|checkout|subscription)/i,
 ];
 
 const SCREEN_TOOL_PATTERN = /(?:browser|computer|playwright|puppeteer|selenium|click|tap|press)/i;
@@ -156,14 +183,14 @@ function remoteFinancialLedgerAnchorStore(options = {}) {
   return {
     read({ ledgerId }) {
       const response = invoke({ operation: 'read', ledgerId });
-      if (!response || response.ok !== true || !Object.hasOwn(response, 'anchor')) {
+      if (response?.ok !== true || !Object.hasOwn(response, 'anchor')) {
         throw financialError('remote financial anchor returned an invalid read response');
       }
       return response.anchor;
     },
     compareAndSet({ ledgerId, expected, next }) {
       const response = invoke({ operation: 'compareAndSet', ledgerId, expected, next });
-      if (!response || response.ok !== true || typeof response.applied !== 'boolean') {
+      if (response?.ok !== true || typeof response.applied !== 'boolean') {
         throw financialError('remote financial anchor returned an invalid compare-and-set response');
       }
       return response.applied;
@@ -324,17 +351,39 @@ function detectEconomicAction(toolName, toolInput = {}) {
   // approved; caller-supplied prose must never downgrade a blind click.
   if (detectOpaqueScreenMutation(normalizedToolName, toolInput)) return true;
   const command = shellEconomicText(normalizedToolName, toolInput.command || toolInput.cmd);
+  const screenMutationProse = isDeclaredScreenMutation(normalizedToolName, toolInput)
+    ? [toolInput.goal, toolInput.description, toolInput.prompt, metadata.context]
+    : [];
+  // WebFetch / browser navigate often put the spend surface only in url/uri/href.
+  const navigationTargets = [
+    toolInput.url,
+    toolInput.uri,
+    toolInput.href,
+    toolInput.link,
+    toolInput.navigate,
+    toolInput.target,
+  ].map((value) => String(value || '')).join(' ');
   const combined = [
     normalizedToolName.replace(/[_-]+/g, ' '),
     command,
-    toolInput.goal,
     toolInput.action,
     toolInput.operation,
-    metadata.context,
+    navigationTargets,
+    ...screenMutationProse,
   ].map((value) => String(value || '')).join(' ');
+  if (ECONOMIC_URL_PATTERNS.some((pattern) => pattern.test(combined))) return true;
   return ECONOMIC_ACTION_PATTERNS.some((pattern) => pattern.test(combined));
 }
 
+function isDeclaredScreenMutation(toolName, toolInput = {}) {
+  if (!SCREEN_TOOL_PATTERN.test(String(toolName || ''))) return false;
+  const input = objectValue(toolInput);
+  const declaredOperation = [input.action, input.operation, input.type]
+    .map((value) => String(value || ''))
+    .join(' ');
+  return SCREEN_MUTATION_PATTERN.test(toolName) || SCREEN_MUTATION_PATTERN.test(declaredOperation);
+}
+
 function detectOpaqueScreenMutation(toolName, toolInput = {}) {
   const normalizedToolName = String(toolName || '').trim();
   const input = objectValue(toolInput);
@@ -372,8 +421,8 @@ function shellEconomicText(toolName, rawCommand) {
   return command
     .split(/(?:&&|\|\||[;\n]|(?<!\|)\|(?!\|))/)
     .map((segment) => {
-      const clean = segment.trim().replace(/^(?:sudo\s+)?(?:env\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=[^\s]+\s+)*/, '');
-      const executable = clean.match(/^([A-Za-z0-9_.\/-]+)/)?.[1]?.split('/').at(-1)?.toLowerCase();
+      const clean = segment.trim().replace(/^(?:sudo\s+)?(?:env\s+)?(?:[A-Za-z_]\w*=[^\s]+\s+)*/, '');
+      const executable = /^([\w./-]+)/.exec(clean)?.[1]?.split('/').at(-1)?.toLowerCase();
       if (['rg', 'grep', 'git', 'cat', 'head', 'tail', 'less', 'more', 'echo', 'printf'].includes(executable)) return '';
       return clean;
     })
@@ -780,40 +829,38 @@ function validateAttachedControl(result) {
   }
 }
 
-function validateRequisition(result, options) {
-  const reconciliation = reconcilePurchaseLedger(options);
-  if (!reconciliation.ok && (reconciliation.invalidEventHashes.length > 0
+function reconciliationHasIntegrityFailure(reconciliation) {
+  return !reconciliation.ok && (
+    reconciliation.invalidEventHashes.length > 0
     || reconciliation.invalidChainLinks.length > 0
     || reconciliation.ledgerHeadMismatches.length > 0
-    || reconciliation.malformedRows.length > 0)) {
-    const anchorUnavailable = reconciliation.ledgerHeadMismatches.some(
-      (entry) => optionalString(entry.rollbackResistantAnchorError)
+    || reconciliation.malformedRows.length > 0
+  );
+}
+
+function blockLedgerIntegrityFailures(result, reconciliation) {
+  const anchorUnavailable = reconciliation.ledgerHeadMismatches.some(
+    (entry) => optionalString(entry.rollbackResistantAnchorError)
+  );
+  const independentTampering = reconciliation.invalidEventHashes.length > 0
+    || reconciliation.invalidChainLinks.length > 0
+    || reconciliation.malformedRows.length > 0
+    || reconciliation.ledgerHeadMismatches.some(
+      (entry) => !optionalString(entry.rollbackResistantAnchorError)
     );
-    const independentTampering = reconciliation.invalidEventHashes.length > 0
-      || reconciliation.invalidChainLinks.length > 0
-      || reconciliation.malformedRows.length > 0
-      || reconciliation.ledgerHeadMismatches.some(
-        (entry) => !optionalString(entry.rollbackResistantAnchorError)
-      );
-    if (independentTampering) {
-      addBlock(result, 'financial_ledger_tampered', 'Financial ledger integrity verification failed.');
-    }
-    if (anchorUnavailable) {
-      addBlock(
-        result,
-        'financial_ledger_anchor_unavailable',
-        'Rollback-resistant financial ledger anchor is unavailable; financial actions fail closed.'
-      );
-    }
-    return;
+  if (independentTampering) {
+    addBlock(result, 'financial_ledger_tampered', 'Financial ledger integrity verification failed.');
   }
-  if (!result.requisitionId) return;
-  const requisition = projectRequisition(result.requisitionId, options);
-  result.requisition = requisition;
-  if (!requisition) {
-    addBlock(result, 'unknown_purchase_requisition', `Purchase requisition '${result.requisitionId}' does not exist.`);
-    return;
+  if (anchorUnavailable) {
+    addBlock(
+      result,
+      'financial_ledger_anchor_unavailable',
+      'Rollback-resistant financial ledger anchor is unavailable; financial actions fail closed.'
+    );
   }
+}
+
+function validateRequisitionBindings(result, requisition, options) {
   try {
     verifyPurchaseApprovalBinding(requisition, options);
   } catch (error) {
@@ -824,6 +871,9 @@ function validateRequisition(result, options) {
   } catch (error) {
     addBlock(result, 'reservation_not_bound_to_approval', error.message);
   }
+}
+
+function validateRequisitionConstraints(result, requisition) {
   if (requisition.status !== 'reserved') {
     addBlock(result, 'requisition_not_reserved', `Purchase requisition '${result.requisitionId}' is ${requisition.status}, not reserved.`);
   }
@@ -846,6 +896,23 @@ function validateRequisition(result, options) {
   if (normalizeToolName(result.actionBinding.toolName) !== normalizeToolName(requisition.approvedToolName)) {
     addBlock(result, 'financial_tool_mismatch', 'Actual financial tool does not match the approved tool.');
   }
+}
+
+function validateRequisition(result, options) {
+  const reconciliation = reconcilePurchaseLedger(options);
+  if (reconciliationHasIntegrityFailure(reconciliation)) {
+    blockLedgerIntegrityFailures(result, reconciliation);
+    return;
+  }
+  if (!result.requisitionId) return;
+  const requisition = projectRequisition(result.requisitionId, options);
+  result.requisition = requisition;
+  if (!requisition) {
+    addBlock(result, 'unknown_purchase_requisition', `Purchase requisition '${result.requisitionId}' does not exist.`);
+    return;
+  }
+  validateRequisitionBindings(result, requisition, options);
+  validateRequisitionConstraints(result, requisition);
   validateScope(result, requisition);
 }
 
@@ -897,7 +964,7 @@ function consumeReservation(input, options) {
     const chain = validateLedgerChain(ledger.events, ledger.malformedRows, ledger.head, options);
     if (!chain.ok) throw financialError('financial ledger integrity check failed before authorization');
     const current = projectRequisitionFromEvents(ledger.events, input.requisitionId, options);
-    if (!current || current.status !== 'reserved') {
+    if (current?.status !== 'reserved') {
       throw financialError(`purchase requisition '${input.requisitionId}' is not available for single-use authorization`);
     }
     if (current.reservationId !== input.reservationId) {
@@ -1070,25 +1137,74 @@ function withLedgerLock(options, callback) {
   });
 }
 
-function recoverLedgerTransaction(options = {}) {
-  const journalPath = getLedgerJournalPath(options);
-  let journal;
+function readLedgerJournal(journalPath) {
   try {
-    journal = JSON.parse(fs.readFileSync(journalPath, 'utf8'));
+    return JSON.parse(fs.readFileSync(journalPath, 'utf8'));
   } catch (error) {
-    if (error.code === 'ENOENT') return;
+    if (error.code === 'ENOENT') return null;
     throw financialError(`cannot recover financial ledger journal: ${error.message}`);
   }
-  const integrityKey = ledgerIntegrityKey(options);
+}
+
+function verifiedJournalEvent(journal, integrityKey) {
+  const event = journal?.event;
   if (journal?.schemaVersion !== LEDGER_JOURNAL_SCHEMA
-    || !journal.event
-    || journal.event.eventHash !== hashEvent(journal.event)
+    || !event
+    || event.eventHash !== hashEvent(event)
     || !verifyIntegrityRecord(journal, integrityKey)) {
     throw financialError('financial ledger journal integrity verification failed');
   }
+  return event;
+}
+
+function recoverAppendedLedgerEvent({
+  ledger,
+  event,
+  previousHead,
+  currentAnchor,
+  headAtPrevious,
+  headAtEvent,
+  journalPath,
+  options,
+}) {
+  const preceding = ledger.events.at(-2) || null;
+  const expectedPrevious = preceding
+    ? { sequence: preceding.sequence, eventHash: preceding.eventHash }
+    : null;
+  const chain = validateLedgerChain(
+    ledger.events,
+    ledger.malformedRows,
+    null,
+    { ...options, skipLedgerHead: true }
+  );
+  const anchorAtPrevious = sameHead(currentAnchor, previousHead);
+  const anchorAtEvent = sameHead(currentAnchor, { sequence: event.sequence, eventHash: event.eventHash });
+  if (!sameHead(previousHead, expectedPrevious)
+    || !chain.ok
+    || (!headAtPrevious && !headAtEvent)
+    || (!anchorAtPrevious && !anchorAtEvent)) {
+    throw financialError('financial ledger journal does not match the recoverable append');
+  }
+  if (!headAtEvent) writeLedgerHeadFile(event, options);
+  if (!anchorAtEvent) advanceFinancialLedgerAnchor(previousHead, event, options);
+  removeDurableFile(journalPath);
+}
 
+function canDiscardPreparedLedgerEvent({ ledger, event, previousHead, currentAnchor, headAtPrevious, options }) {
+  const currentChain = validateLedgerChain(ledger.events, ledger.malformedRows, ledger.head, options);
+  return currentChain.ok
+    && headAtPrevious
+    && sameHead(currentAnchor, previousHead)
+    && event.sequence === ledger.events.length + 1;
+}
+
+function recoverLedgerTransaction(options = {}) {
+  const journalPath = getLedgerJournalPath(options);
+  const journal = readLedgerJournal(journalPath);
+  if (!journal) return;
+  const integrityKey = ledgerIntegrityKey(options);
+  const event = verifiedJournalEvent(journal, integrityKey);
   const ledger = readLedger(options);
-  const event = journal.event;
   const currentLast = ledger.events.at(-1) || null;
   const previousHead = journal.previousHead;
   const currentHead = ledger.head;
@@ -1099,35 +1215,27 @@ function recoverLedgerTransaction(options = {}) {
   const headAtEvent = sameHead(currentHead, { sequence: event.sequence, eventHash: event.eventHash });
 
   if (eventAlreadyAppended) {
-    const preceding = ledger.events.at(-2) || null;
-    const expectedPrevious = preceding
-      ? { sequence: preceding.sequence, eventHash: preceding.eventHash }
-      : null;
-    const chain = validateLedgerChain(
-      ledger.events,
-      ledger.malformedRows,
-      null,
-      { ...options, skipLedgerHead: true }
-    );
-    const anchorAtPrevious = sameHead(currentAnchor, previousHead);
-    const anchorAtEvent = sameHead(currentAnchor, { sequence: event.sequence, eventHash: event.eventHash });
-    if (!sameHead(previousHead, expectedPrevious)
-      || !chain.ok
-      || (!headAtPrevious && !headAtEvent)
-      || (!anchorAtPrevious && !anchorAtEvent)) {
-      throw financialError('financial ledger journal does not match the recoverable append');
-    }
-    if (!headAtEvent) writeLedgerHeadFile(event, options);
-    if (!anchorAtEvent) advanceFinancialLedgerAnchor(previousHead, event, options);
-    removeDurableFile(journalPath);
+    recoverAppendedLedgerEvent({
+      ledger,
+      event,
+      previousHead,
+      currentAnchor,
+      headAtPrevious,
+      headAtEvent,
+      journalPath,
+      options,
+    });
     return;
   }
 
-  const currentChain = validateLedgerChain(ledger.events, ledger.malformedRows, ledger.head, options);
-  if (currentChain.ok
-    && headAtPrevious
-    && sameHead(currentAnchor, previousHead)
-    && event.sequence === ledger.events.length + 1) {
+  if (canDiscardPreparedLedgerEvent({
+    ledger,
+    event,
+    previousHead,
+    currentAnchor,
+    headAtPrevious,
+    options,
+  })) {
     // The crash happened before the event append. The caller never received a
     // success response, so discard the prepared transaction instead of
     // executing it during recovery.
@@ -1268,7 +1376,7 @@ function signIntegrityRecord(record, key) {
 
 function verifyIntegrityRecord(record, key) {
   const auth = record?.auth;
-  if (!record || !auth || auth.algorithm !== 'hmac-sha256') return false;
+  if (!record || auth?.algorithm !== 'hmac-sha256') return false;
   const expectedKeyId = crypto.createHash('sha256').update(key).digest('hex').slice(0, 16);
   if (auth.keyId !== expectedKeyId || !/^[a-f0-9]{64}$/i.test(String(auth.signature || ''))) return false;
   const expected = crypto.createHmac('sha256', key).update(integrityPayload(record)).digest();
@@ -1365,7 +1473,7 @@ function verifyPurchaseApprovalBinding(requisition, options) {
   } catch (error) {
     throw financialError(`requisition '${requisition.requisitionId}' approval verification failed: ${error.message}`);
   }
-  if (!escalation || escalation.status !== 'approved') {
+  if (escalation?.status !== 'approved') {
     throw financialError(`requisition '${requisition.requisitionId}' does not have independent human approval`);
   }
   const expectedApprovalContextDigest = requestComparableHash(requisition);
@@ -1495,6 +1603,7 @@ function financialError(message) {
 
 module.exports = {
   ECONOMIC_ACTION_PATTERNS,
+  ECONOMIC_URL_PATTERNS,
   createPurchaseRequisition,
   buildActionAuthorization,
   detectEconomicAction,

package/scripts/gates-engine.js

@@ -164,6 +164,10 @@ const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
   'secret-exfiltration',
   'security-vuln-scan',
   'slopsquat-guard',
+  // Money path: even if a refactor later routes financial denials through
+  // applyEnforcementPosture, never demote spend blocks to warn-by-default.
+  // Apollo $588 incident class (2026-08).
+  'financial-control',
   TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
   ...SELF_PROTECT_HARD_FLOOR_GATE_IDS,
 ]);
@@ -175,12 +179,15 @@ const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
 // `git reset --hard`, or `git clean -f` silently allowed through. These four
 // map directly to CLAUDE.md's own hard-block list and must never be subject
 // to the daily cap discount, regardless of tier or strict-mode setting.
+// financial-control is included for the same reason: a daily-cap discount on
+// checkout/subscription spends would re-open the never-spend interlock.
 const CATASTROPHIC_DECLARATIVE_GATE_IDS = new Set([
   TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
   'force-push',
   'git-reset-hard',
   'git-clean-force',
   'rm-rf-home-or-root',
+  'financial-control',
 ]);
 const SELF_PROTECT_CONFIG_TARGET_PATTERN = /(?:^|\/)(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json$|\.thumbgate\/config\.json$|thumbgate\.json$)/i;
 const SELF_PROTECT_HOOK_TARGET_PATTERN = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^/]+\.(?:js|sh))$/i;
@@ -3387,8 +3394,9 @@ function evaluateUnconditionalHardFloor(input = {}, options = {}) {
 
 function evaluateFinancialHardFloor(input = {}, consumeReservation = false, options = {}) {
   const toolName = input.tool_name || input.toolName || 'unknown';
-  const toolInput = input.tool_input && typeof input.tool_input === 'object'
-    ? input.tool_input
+  const rawToolInput = input.tool_input ?? input.toolInput;
+  const toolInput = rawToolInput && typeof rawToolInput === 'object'
+    ? rawToolInput
     : {};
   const normalizedAction = normalizeProviderAction({
     toolName,

package/server.json

@@ -8,13 +8,13 @@
     "source": "github",
     "url": "https://github.com/IgorGanapolsky/ThumbGate"
   },
-  "version": "1.34.0",
+  "version": "1.34.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "thumbgate",
-      "version": "1.34.0",
+      "version": "1.34.2",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {