[TheGreatAxios]

Summary

• Kills the two worst silent swallows: a torn permissions approvals file is no longer read back as an empty store (ENOENT stays legitimate-empty; any parse/corruption error becomes a named, surfaced failure that aborts the read AND the pre-read of every read-modify-write, so a torn file can never be silently clobbered by the next grant) — previously a torn file plus one grant write permanently discarded all prior allow-always grants, including the implicit revocation-by-absence wipe on the project trust fingerprint path.
• Stall-after-interrupt approval resumes stop collapsing every resume-path throw into an opaque refused("error") that looked identical to a system decline: the refusal now carries a scrubbed cause (error class + message with secret shapes AND correlation-ID shapes neutralized before the warn line) and a structured warn with the redacted correlation id; turn-marker consumers are shape-stable (only handled/code read).
• The seven audit-verified subtle swallow sites (aged image markers with dead ids, dropped prior handoffs, compaction evidence gaps, corrupt MCP OAuth state backed up as .corrupt before overwrite, evidence-archive skips, stream-journal drain failures, stale model picker) each log with their identifying context; archived-skip receipts scrub on both success and error paths. Stretch items: oauth scope-check causes name the HTTP status or a timed-out probe; upgrade skip reasons name class: message.

Verification

• Failing-test-first repros: torn store (write refusal + repair recovery + clobber-corruption), serene refused-cause (real failing doubles driving the actual resume catch with both content-free code and propagated cause asserted).
• Negative regressions: a persist failing with a secret-shaped message and a correlation id inside causes — the surface detail carries neither in full form (scrub + ID-shape redaction).
• bun run check exit 0: 8,975 pass / 0 fail across 584 files; targeted store/resume/auth/upgrade suites green.
• Boot-fail-on-corrupt-store is intentional fail-closed behavior (named in the plan); operator error copy names path + cause.

Fixes CL-10673

[linear-code]

CL-10673

[corbits-triage]

Superseded by the comment below.

[corbits-triage]

Superseded by the comment below.

[corbits-triage]

This supersedes the comment above because the rules changed: repository policy version 16 → version 19.

Triage: Pass

No changes needed from you. A maintainer will review this pull request.