An unattended run's permissions are settled before launch

An unattended run's tool permissions are something you settle before launch — and this release says so, in the one chapter that was quietly assuming otherwise.

pattern/one-working-shape.md told a builder to bound a headless run with an external timer, an output ceiling and a standing prefix, then closed with "A headless run that needs your person mid-flight fails loudly and queues the question for morning instead of guessing." Every other clause in that paragraph names a mechanism. That one named none — and a reader who built exactly what the page said could still get a silent stall.

The seed taught detection of silence everywhere and prevention nowhere. Measured before writing: permission appears 42 times across the tree and not one hit concerns the harness's runtime approval gate; every one is about grants from your person, injection, or the autonomy ladder.

Why a general "hangs are invisible" lesson does not cover it. A network hang is nondeterministic and a timeout-plus-retry is the right answer. A permission hang recurs identically every night, no retry helps, and the page's own prescribed external timeout misdiagnoses it — the parked run burns its whole budget and reports a timeout, so the obvious next fix is a longer one, which buys nothing.

What is new is a paragraph, not a chapter, added after the normative sentence rather than over it, hedged on whether your harness can pre-declare permissions at all, and carrying an obligation rather than a guarantee: whatever you pre-authorize must still leave writes scoped and reviewable (hardening §2), so an unscoped shell visibly fails the test.

Also in this release: nothing. A sibling candidate — that a tool depends on the shape of its configuration and never on your values — was carried through three drafting rounds and three independent cold reads and is closed unshipped, because LESSONS.md's entry bar is that the failure which paid for a lesson is its provenance, and that one has no scar it could honestly bring. The seed already covers the neighboring ground.

Gate: four independent cold adversarial reads over four revisions, artifact-only, each briefed to argue for rejection; blocked every time until the last. Two earlier attempts were reverted rather than patched when a round blocked on text that same round had introduced.

(Footer added 2026-08-31: this release shipped without the sovereignty footer, which CONTRIBUTING.md and SEED.md both class as a release defect. Nothing else in these notes is changed.)

Take what fits, item by item; nothing here can weaken a floor.