Detent v0.4.0

Security fix

dispatch.main() previously failed open on any internal error inside a move — including
the outbound secret-leak gate (outbound_deny_secret_pattern). If Detent errored while
evaluating an outbound call to a mcp__*/WebFetch/WebSearch tool, the gate silently vanished
and the call proceeded unchecked, instead of blocking it.

As of this release, an internal error during (PreToolUse, →WORLD-class tool) now fails
closed: the call is denied with an explicit reason, not silently allowed. Every other
event (rewrites, capture) is unaffected and still fails open, which is correct there —
availability, not enforcement, is at stake.

Upgrade recommended if you rely on the outbound secret gate. There is no CVE filed for the
prior behavior; this is a hardening fix, not a report of exploitation.

New capability

• Edit pointer expansion, via the documented defer → PermissionRequest seam. This
  client validates Edit.old_string before PreToolUse rewrites apply, so a pointer-form
  Edit (detent://L<a>-<b> or detent://<addr>) now defers to PermissionRequest, where the
  expansion applies as a condition of approval — before validation runs.
• FileChanged capture. File states written by anything other than the model's own
  Edit/Write (Bash redirects, build output, external processes) now become addressable on
  occurrence, closing a gap native checkpointing doesn't cover.

Internal

• dispatch.route() is now one table — ENVELOPE[(event, result-type)] → shape — instead of
  branch logic. Adding a protocol capability is now a row, not a branch.
• The public test suite grows from 6 to 157: the falsifiability/law-verification battery
  (test_laws.py — guard totality, rewrite idempotence, store monotonicity) now ships in this
  repo instead of staying dev-only.

Full Changelog: v0.3.0...v0.4.0