Fixed — durable-loop write detection aligned with the executor. The interactive loop's approval gate (is_write_step) used a narrower verb set than the executor's intent parser (_parse_agent_intent), so a free-text step phrased with a synonym verb (remove/clear/set/modify/rename/purge/…) was a read to the gate but a write to the executor — and could inline-execute in an interactive loop with no approval pause.
Root-cause fix: a single shared classify_intent_type (in sequential_dispatch.py) that both the gate and the executor use, so they can never disagree. is_write_step is now an additive union — nothing that previously gated stops gating; the change only closes the hole. Reads keep priority, so a genuine read is never over-gated.
Surfaced by the R15 (scheduled tasks, v0.2.13) pre-ship review, which had already guarded scheduled runs against the same divergence.
+21 tests; full suite 1288 passed, 1 skipped on Python 3.12. CI green.